RomCom is a RAT – that enables remote access/control over devices to exfiltrate sensitive information for financial gain, now being used in geo politically-motivated attacks against Ukraine’s military institutions.
According to the Blackberry threat intelligence team, the threat actor targets NATO Submit guests through RTF Exploitation.
Threat actors took advantage of this event and sent malicious documents impersonating Ukraine congress to the supporters of Ukraine.
Exploitation
Lithuania is hosting a NATO Summit in Vilnius on July 11-12. The presence of the President of Ukraine Zelenskyy was confirmed and will be having a discussion of membership with Ukraine in the future.
The threat actors cloned the website of the Ukraine Congress by adding the “.info” suffix to look legitimate.
Using the typosquatting Technique, they have created a fake domain ukrainianworldcongress[.]info which looks like the original domain ukrainianworldcongress[.]org.
Then, the Spear phishing technique is used to spread the malicious document “Overview_of_UWCs_UkraineInNATO_campaign.docx” containing an embedded RTF file named afchunk.rtf to the victims
Once the document gets executed by the user, it will connect to proxies services and run SMP and HTTPS ports.
The OLE object in the RTF file renders Iframe tags to download additional files to execute the attack.
The next stage of the attack is carried out by exploiting the vulnerability CVE-2022-30190 in the victim’s machine.
It is a zero-day vulnerability affecting Microsoft’s Support Diagnostic Tool (MSDT) with freely available proof of concept (POC) exploit code appearing in the wild.
Through malicious document files, this vulnerability could be exploited by remote code exploitation attempts which leverage the additional payloads.
After the sequence of scripts starts the final payload—RomCom downloader—the file connects to the remote server to register the new victim, according to the report.
When the payload is successfully downloaded, the RomCom downloader starts the Windows service.
- The size of the device’s RAM
- Username
- Information about the machine’s network adapter.
Indicator of compromise
SHA256- A61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f SHA256-3a3138c5add59d2172ad33bc6761f2f82ba344f3d03a2269c623f22c1a35df97 SHA256-e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539 SHA256-07377209fe68a98e9bca310d9749daa4eb79558e9fc419cf0b02a9e37679038d