DustyHammock
DustyHammock is a Rust-based minimalist backdoor associated with RomCom/TA829 activity, including clusters also tracked as Storm-0978, Tropical Scorpius, Void Rabisu, Nebulous Mantis, and UNC2596. It is described as serving as a core backdoor for long-term command-and-control communication and remote command execution. Reported capabilities include executing commands via cmd.exe and downloading and executing additional files. Its beacon structure is highly similar to SingleCamper, suggesting both variants may be administered from the same panel. DustyHammock has been delivered by the MeltingClaw and RustyClaw downloaders, and reporting also places it in the broader TA829/RomCom toolchain alongside SlipScreen, ShadyHammock, and SingleCamper. The surrounding campaigns used phishing and lure themes such as job applications, complaints, resumes, invoices, and supplier/customer messages, often with spoofed OneDrive or Google Drive links, password-protected archives, or executables masquerading as PDF readers. Reported targeting tied to the broader RomCom/TA829 operations included government, defense, financial, manufacturing, logistics, retail, hospitality, and critical infrastructure organizations across Europe, North America, the UK, Ukraine, and Poland. No DustyHammock-specific indicators of compromise beyond its behavioral characteristics and delivery relationships are directly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...downloaders that deliver the ShadyHammock, DustyHammock, and SingleCamper backdoors.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-based core backdoor used for persistent, long-term C2 communications and remote command execution in RomCom espionage operations.
Backdoor delivered by MeltingClaw/RustyClaw in TA829 intrusions.
DustyHammock is a minimalist backdoor used by TA829 for command execution, downloading and running additional files, and network reconnaissance. It is used as a foothold for further compromise and can facilitate data theft or ransomware deployment.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.