A current investigation by Pattern Micro has revealed a brand new wave of the RomCom malware marketing campaign, which includes imposters creating web sites that mimic well-known or fictional software program. These malicious websites trick unsuspecting customers into downloading and launching contaminated installers, resulting in the set up of the RomCom malware.
Researchers from Pattern Micro have been monitoring RomCom for the reason that summer season of 2022 and have noticed that the risk actors behind the malware have enhanced its evasion strategies. The marketing campaign now employs payload encryption, obfuscation, and incorporates new highly effective instructions to broaden the malware’s capabilities.
RomCom is primarily distributed via web sites associated to distant desktop administration functions, making it seemingly that attackers are utilizing phishing or social engineering ways to focus on their victims.
Palo Alto Networks initially reported the primary documented use of RomCom in August 2022, linking the assaults to a Cuba ransomware affiliate named ‘Tropical Scorpius.’ Pattern Micro has recognized the identical actor and makes use of the identify ‘Void Rabisu’ to trace them.
In October 2022, Ukraine’s CERT-UA reported that the RomCom malware was being utilized in focused assaults in opposition to essential networks within the nation. A report revealed by BlackBerry across the similar time confirmed the affiliation with Cuba ransomware and likewise highlighted victims in the USA, Brazil, and the Philippines.
The present RomCom marketing campaign, as detailed by Pattern Micro, lists varied examples of internet sites utilized by the malware operators between December 2022 and April 2023. These websites impersonate reputable software program, together with Gimp, Go To Assembly, ChatGPT, WinDirStat, AstraChat, System Ninja, and Devolutions’ Distant Desktop Supervisor, amongst others.
The pretend web sites are promoted via focused phishing emails and Google commercials, with a major variety of victims positioned in Japanese Europe.
The malicious web sites distribute trojanized MSI installers that look like reputable apps however comprise a malicious DLL file (“InstallA.dll”). When executed, this file extracts three further DLLs to the sufferer’s %PUBLICpercentLibraries folder, enabling command and management server communications and command execution.
The most recent model of the RomCom payload analyzed by Pattern Micro demonstrates a rise in malicious instructions, with the quantity rising from 20 to 42. These instructions present in depth capabilities to the attackers, together with spawning processes with PID spoofing, information exfiltration, organising proxies by way of SSH, and working hidden functions like AnyDesk.
Moreover, Pattern Micro has noticed circumstances the place RomCom installs further malware payloads, comparable to screenshot-snapping instruments, net browser cookies stealers, cryptocurrency pockets stealers, and immediate messenger chat stealers.
To evade detection, RomCom employs VMProtect software program for code safety and anti-VM capabilities. The malware additionally makes use of encryption for the payload, with the encryption key obtained from an exterior supply. Moreover, the malware incorporates null bytes in its command and management communication to keep away from detection by community monitoring instruments.
The software program downloaded from the malicious web sites is signed with seemingly reputable firms based mostly within the U.S. and Canada, though these firms’ web sites comprise pretend or plagiarized content material.
Dror Liwer, co-founder of cybersecurity firm Coro shared a perspective on the risk:
“It has grow to be normal working process for risk actors that develop refined assault strategies for political functions to monetize these strategies by both utilizing them themselves for industrial functions, or making them out there for a price on the darkish net as soon as their political usefulness has been maximized. The truth that a risk actor has political motivations shouldn’t lull us right into a false sense of safety. The strategies developed will find yourself out there focusing on companies and people for revenue.”
RomCom has been related to ransomware, espionage, and warfare, and the motives of its operators stay unclear. However, it poses a flexible risk able to inflicting important injury.
Pattern Micro has offered an in depth listing of indicators of compromise (IoCs) for the newest RomCom marketing campaign and has launched Yara guidelines to help defenders in detecting and stopping these assaults.
###
