Loading story…
Proofpoint reported that activity tied to TA829 and a separate cluster it tracks as UNK_GreenSec used overlapping phishing infrastructure and social-engineering lures, even as the two operations delivered different malware. TA829 continued deploying its established RomCom-related toolset — including SlipScreen, RustyClaw, MeltingClaw, DustyHammock, ShadyHammock, and SingleCamper — while UNK_GreenSec used the newer TransferLoader, which researchers linked to Metasploit and Morpheus ransomware. Both clusters abused compromised MikroTik routers as REM Proxy nodes, used freemail senders and Rebrandly redirects, and relied on landing pages themed around OneDrive or Google Drive.
A follow-on infrastructure review of 109 domains found additional overlap between the RomCom and TransferLoader ecosystems, including four TransferLoader IoC domains appearing across five typosquatting groups and shared registrar, registrant-country, nameserver, and IP patterns. Researchers said many domains were registered shortly before use, while 27 of 109 had already been flagged as likely malicious 77 to 271 days before they were later published as IoCs. The broader artifact set also included thousands of email- and string-linked domains, dozens of related malicious domains and IPs, and recurring use of Tucows and U.S.-based registrations, reinforcing evidence of a meaningful operational relationship without conclusively proving the two clusters are the same actor.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
On 30 June 2025, Proofpoint published "10 Things I Hate About Attribution: RomCom vs. TransferLoader," concluding there was likely some relationship between TA829 and UNK_GreenSec but insufficient evidence to determine the exact linkage.
WhoisXML API reported that livestorage[.]click appeared in a seven-domain typosquatting group created on 15 April 2025.
In April 2025, Proofpoint observed TA829 shift to using the ShadyHammock and SingleCamper tool suite in financially motivated campaigns.
Proofpoint said UNK_GreenSec used more advanced filtering before TA829 later adopted similar filtering practices in March 2025.
WhoisXML API found that dr365[.]live appeared in a four-domain typosquatting group created on 21 February 2025.
WhoisXML API reported that 1drive[.]expert appeared in a six-domain typosquatting group created on 14 February 2025. The group used Tucows, Alibaba, and Shanghai Fuhu Information Technology as registrars and multiple DNS providers.
Proofpoint observed UNK_GreenSec conduct four TransferLoader campaigns in the first two weeks of February 2025 targeting North America.
During February 2025, Proofpoint observed highly similar email campaigns and redirection infrastructure used by TA829 and UNK_GreenSec. It initially clustered the activity with TA829 before later separating it based on infection-chain and malware differences.
Proofpoint reported that TA829 resumed operations in February 2025, returning to campaigns that used plaintext phishing emails, freemail senders, and spoofed cloud-storage links.
WhoisXML API found that all 20 RomCom IoC domains were created in 2025 between 20 January 2025 and 11 June 2025, with the first observed creation date on 20 January 2025.
WhoisXML API found that the 89 TransferLoader IoC domains were created between 2 October 2024 and 14 April 2025, marking the start of the observed domain-registration window for that cluster.
Proofpoint said TA829 resumed operations in February 2025 after it was last observed in October 2024, establishing October 2024 as the group's prior known activity before the pause.
Barracuda states that RomCom RAT was first identified in 2022. The malware was initially used primarily against Ukrainian and Polish targets before later being adapted to financial crime activity.
WhoisXML API published analysis of 109 RomCom and TransferLoader IoC domains, highlighting typosquatting-group overlaps and noting that 27 domains had been flagged as likely malicious before they were reported as IoCs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
circleid.com
Open sourceblog.barracuda.com
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced multiple **SmokeLoader** operations to live command-and-control infrastructure that supported credential theft, screenshot capture, clipboard theft, host profiling, and data exfiltration. One March 2026 campaign used a **ClickFix** social-engineering lure, an MSI installer, and a Go-based loader to deploy the **Remus** plugin, with exfiltration sent to `baxe[.]pics:48261`; investigators extracted configuration data including the C2 URL, campaign ID, plugin markers, and a **ChaCha20** key that allowed captured traffic to be decrypted. Cross-sample analysis linked the same builder output to SmokeLoader deliveries via **Amadey**, **Phorpiex**, and the ClickFix/GOLoader chain, pointing to a shared malware-as-a-service or affiliate ecosystem. Separate analysis tied SmokeLoader to a broader dual-family operation involving **Fuery**, likely run by an operator using the alias **"ingermany"**, who used a Flask-based panel disguised as **"InsureFlow Pro"** and a second **"Monkey"** panel for Fuery management. Investigators documented repeated OPSEC failures across the infrastructure, including reused certificates, exposed registration data, same-day domain registrations, and a C2 domain that shared a VPS with a legitimate Arabic-language learning platform, `qimmaedu[.]com`, while malware traffic beaconed to `coox[.]live` and `baxe[.]pics`. The reports also highlighted unusual technical overlaps, including Go 1.20.1 builds, Raft protocol type-name obfuscation, split C2 services on high ports, and hosting links to providers and subnets previously associated with **Phorpiex**, reinforcing the assessment that financially motivated operators were reusing infrastructure across malware families and legitimate services.
Jun 29, 2026
ESET reported that the Russia-aligned **RomCom** group actively exploited the WinRAR zero-day **`CVE-2025-8088`**, a path traversal flaw involving Windows Alternate Data Streams that let malicious archives appear harmless while dropping files during extraction. The attacks used spearphishing emails with **CV/resume-themed RAR attachments** to target organizations in finance, manufacturing, defense, and logistics across Europe and Canada, and the exploitation chain deployed RomCom-associated tooling including a **Mythic** agent, a **SnipBot** variant, and **RustyClaw/MeltingClaw** downloaders. ESET said the flaw was fixed in **WinRAR 7.13**, warned that other actors also began exploiting it, and urged updates for WinRAR and downstream **UnRAR.dll** consumers. Separate reporting from Trend Micro described 2025 intrusion campaigns tracked as **SHADOW-VOID-042** that showed overlap with activity previously attributed to **Void Rabisu/ROMCOM**, though attribution remained unconfirmed. Those operations used tailored social-engineering lures aimed at executives and HR staff, and later impersonated Trend Micro browser security and Apex One updates against Trend Micro, a subsidiary, a partner, and other organizations. Recovered components showed a multi-stage chain using a Cloudflare-themed landing page, JavaScript exploiting **`CVE-2018-6065`**, delivery of an encrypted binary to `C:\ProgramData\Microsoft\Windows\SystemProcessHost.exe`, and persistence through a scheduled task running as **SYSTEM**; Trend Micro said early disruption prevented recovery of the final payload.
Aug 21, 2026
VMRay Labs detailed **Operation STANDOFF**, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install `NSIS` loader masquerading as `setup_x86_x64_install.exe`. The operation has been observed deploying **Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig**, and **WebBrowserPassView**, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry `Run` keys, fake VirtualBox-named services, and a masqueraded `csrss.exe` path, while a gaming-themed **“Mobile Arena”** lure targeted young Russian-speaking users. The campaign’s infrastructure included command-and-control systems hosted on **TimeWeb Ltd.**, a broader 44-server cluster, and dead-drop resolvers on **Telegram, Mastodon, and Pastebin**. Additional reporting tied the operation to command-and-control traffic concealed behind **GitHub redirects** and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and **Monero** mining infrastructure such as `pool.supportxmr.com:3333`. VMRay also identified **STANDOFF COORD**, a Russian-language multi-operator console designed for **Active Directory** intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.
Jul 28, 2026