RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine
Tags
country: Ukraine
maec-delivery-vectors: Watering Hole
attack-pattern: Asymmetric Cryptography - T1573.002 Component Object Model Hijacking - T1546.015 Credentials - T1589.001 Data Encrypted For Impact - T1486 Domains - T1583.001 Domains - T1584.001 Hidden Files And Directories - T1564.001 Inter-Process Communication - T1559 Phishing - T1660 Phishing - T1566 Phishing For Information - T1598 Software - T1592.002 Spearphishing Attachment - T1598.002 Ssh - T1021.004 Web Protocols - T1071.001 Standard Application Layer Protocol - T1071 Browser Bookmark Discovery - T1217 Connection Proxy - T1090 Deobfuscate/Decode Files Or Information - T1140 Drive-By Compromise - T1189 Exfiltration Over Command And Control Channel - T1041 File And Directory Discovery - T1083 Remote File Copy - T1105 Masquerading - T1036 Modify Registry - T1112 Standard Non-Application Layer Protocol - T1095 Obfuscated Files Or Information - T1027 Process Discovery - T1057 Screen Capture - T1113 Signed Binary Proxy Execution - T1218 Third-Party Software - T1072 System Information Discovery - T1082 User Execution - T1204
Show in Graph
Common Information
Type Value
UUID b15566e9-55c1-442e-aa76-b98f770939a1
Fingerprint a4b4a9916c32f7c9
Analysis status DONE
Considered CTI value 2
Text language
Published June 7, 2023, 1 a.m.
Added to db Oct. 22, 2023, 9:37 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine
Title RomCom Resurfaces: Targeting Politicians in Ukraine and U.S.-Based Healthcare Providing Aid to Refugees from Ukraine
Detected Hints/Tags/Attributes 67/3/31
Source URLs
Redirection Url
Details Source https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
URL Provider
Details Provider Source level domain
Details blackberry.com blogs.blackberry.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 56 ✔ Latest Articles - BlackBerry Blogs https://blogs.blackberry.com/en/feed.rss 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 3 
startleague.net
Details Domain 3 
devolutions.net
Details Domain 3 
rdp-devolutions.com
Details File 108 
0.exe
Details sha256 2 
c94e889a6c9f4c37f34f75bf54e6d1b2cd7ee654cd397df348d46abe0b0f6ca3
Details IPv4 3 
22.3.35.0
Details MITRE ATT&CK Techniques 100 
T1598
Details MITRE ATT&CK Techniques 13 
T1598.002
Details MITRE ATT&CK Techniques 183 
T1189
Details MITRE ATT&CK Techniques 25 
T1559
Details MITRE ATT&CK Techniques 121 
T1218
Details MITRE ATT&CK Techniques 420 
T1204
Details MITRE ATT&CK Techniques 20 
T1546.015
Details MITRE ATT&CK Techniques 627 
T1027
Details MITRE ATT&CK Techniques 504 
T1140
Details MITRE ATT&CK Techniques 348 
T1036
Details MITRE ATT&CK Techniques 94 
T1564.001
Details MITRE ATT&CK Techniques 550 
T1112
Details MITRE ATT&CK Techniques 433 
T1057
Details MITRE ATT&CK Techniques 585 
T1083
Details MITRE ATT&CK Techniques 1006 
T1082
Details MITRE ATT&CK Techniques 29 
T1217
Details MITRE ATT&CK Techniques 219 
T1113
Details MITRE ATT&CK Techniques 422 
T1041
Details MITRE ATT&CK Techniques 152 
T1090
Details MITRE ATT&CK Techniques 444 
T1071
Details MITRE ATT&CK Techniques 442 
T1071.001
Details MITRE ATT&CK Techniques 159 
T1095
Details MITRE ATT&CK Techniques 74 
T1573.002
Details MITRE ATT&CK Techniques 492 
T1105
Details MITRE ATT&CK Techniques 472 
T1486