RomCom Threat Actor Suspected of Targeting Ukraine’s NATO Membership Talks at the NATO Summit

MITRE Techniques

• [T1566.001] Spearphishing Attachment – The infection chain begins with malicious documents delivered as lures; “Attack Vector: Unconfirmed (highly likely email)” and the infection technique is RTF exploitation.
• [T1203] Exploitation for Client Execution – CVE-2022-30190 (Follina) is used to achieve remote code execution via a crafted document; “
  This execution chain utilizes CVE-2022-30190, which is a zero-day vulnerability … remote code execution (RCE)-based attack via the crafting of a malicious .docx or .rtf document designed to exploit the vulnerability.”
• [T1036] Masquerading – Typosquatting techniques used to masquerade the fake Ukrainian World Congress site as ukrainenworldcongress[.]info, imitating the legitimate domain ukrainianworldcongress[.]org.
• [T1071.001] Web Protocols – The main payload communicates with remote infrastructure, “connects to the remote server to register the new victim,” using HTTP/HTTPS channels.
• [T1543.003] Create or Modify System Process: Windows Service – “When the payload is successfully downloaded, the RomCom downloader starts the Windows service.”
• [T1060] Registry Run Keys/Startup Folder – The RomCom downloader writes security.dll to autorun to be permanently present in the system.
• [T1027] Obfuscated/Compressed Files and Information – The downloader uses string encryption/decryption, with a dedicated decryption key per string; “All RomCom RAT samples we analyzed contained string encryption.”