RomCom is a RAT – that enables remote access/control over devices to exfiltrate sensitive information for financial gain, now being used in geo politically-motivated attacks against Ukraine’s military institutions.

 According to the Blackberry threat intelligence team, the threat actor targets NATO Submit guests through RTF  Exploitation.

Threat actors took advantage of this event and sent malicious documents impersonating Ukraine congress to the supporters of Ukraine.


Lithuania is hosting a NATO Summit in Vilnius on July 11-12. The presence of the President of Ukraine Zelenskyy was confirmed and will be having a discussion of membership with Ukraine in the future.

The threat actors cloned the website of the Ukraine Congress by adding the “.info” suffix to look legitimate.

Fig: Cloned fake website

Using the typosquatting Technique, they have created a fake domain ukrainianworldcongress[.]info which looks like the original domain ukrainianworldcongress[.]org.

Then, the Spear phishing technique is used to spread the malicious document “Overview_of_UWCs_UkraineInNATO_campaign.docx” containing an embedded RTF file named afchunk.rtf to the victims

Fig: Word document sent through phishing

Once the document gets executed by the user, it will connect to proxies services and run SMP and HTTPS ports.

The OLE object in the RTF file renders Iframe tags to download additional files to execute the attack.

The next stage of the attack is carried out by exploiting the vulnerability CVE-2022-30190 in the victim’s machine.

It is a zero-day vulnerability affecting Microsoft’s Support Diagnostic Tool (MSDT)  with freely available proof of concept (POC) exploit code appearing in the wild.

Through malicious document files, this vulnerability could be exploited by remote code exploitation attempts which leverage the additional payloads.

After the sequence of scripts starts the final payload—RomCom downloader—the file connects to the remote server to register the new victim, according to the report.

When the payload is successfully downloaded, the RomCom downloader starts the Windows service.

The RomCom downloader also collects information about the system on which it is running. Such as:

  • The size of the device’s RAM
  • Username
  • Information about the machine’s network adapter.

Indicator of compromise

SHA256- A61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f

“AI-based email security measures Protect your business From Email Threats!” – Request a Free Demo.

Sujatha is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under her belt in Cyber Security, she is covering Cyber Security News, technology and other news.


Please enter your comment!
Please enter your name here