Void Rabisu [1] [2] [3] [4] [5] [6], also known as Storm-0978 [2], Tropical Scorpius [1] [2] [3], and UNC2596 [1] [2] [3], is a threat actor associated with the RomCom RAT malware and the Cuba ransomware. This group conducts financially motivated and espionage attacks [2] [4] [6], primarily targeting Ukraine and countries supporting Ukraine in its conflict with Russia [2].
Description
Void Rabisu has been implicated in exploiting a remote code execution flaw in Microsoft Office and Windows HTML [2] [6]. In August 2023 [6], they launched updated attacks using a slimmed-down version of RomCom RAT called PEAPOD. This malware is distributed through spear-phishing emails and fake advertisements on search engines [4] [6]. The targets of these attacks are specifically European Union navy personnel and political leaders involved in gender equality initiatives. The malware is disguised as a folder containing photos from the Women Political Leaders Summit and is delivered through the website wplsummit[. [2] [4]]com.
This shift in targeting comes after Void Rabisu moved away from opportunistic ransomware attacks [5]. The ROMCOM backdoor is still being developed by the threat actor [5]. While there is no evidence that Void Rabisu is nation-state-sponsored [4] [6], it is possible that they are financially motivated actors who have become involved in cyberespionage due to the conflict in Ukraine [2] [6].
Conclusion
The attacks conducted by Void Rabisu have significant implications for European Union military personnel and political leaders. It is crucial for organizations and individuals to be aware of the threat posed by RomCom RAT and take necessary precautions to protect their systems and data. Cybersecurity firms [1] [3], like Trend Micro [1] [3], play a vital role in tracking and identifying threat actors like Void Rabisu. Continued monitoring and collaboration are essential to mitigate the risks posed by such malicious actors in the future.
References
[1] https://cyber.vumetric.com/security-news/2023/10/13/new-peapod-cyberattack-campaign-targeting-women-political-leaders/
[2] https://thehackernews.com/2023/10/new-peapod-cyberattack-campaign.html
[3] https://www.linkedin.com/posts/wdevaultnew-peapod-cyberattack-campaign-targeting-activity-7118618409885421570-cp0U
[4] https://www.ihash.eu/2023/10/new-peapod-cyberattack-campaign-targeting-women-political-leaders/
[5] https://www.trendmicro.com/enus/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html
[6] https://y2fear.com/new-peapod-cyberattack-marketing-campaign-focusing-on-girls-political-leaders/
