RomCom RAT is being distributed by hackers Using Rogue Versions of KeePass and SolarWinds Software

With the use of rogue versions of software such as SolarWinds Network Performance Monitor, KeePass password manager, and PDF Reader Pro, the operators of RomCom RAT are continuing to evolve their campaigns.

Targets of the operation consist of victims in Ukraine and select English-speaking countries like the U.K.

“Given the geography of the targets and the current geopolitical situation, it’s unlikely that the hackers like RomCom RAT threat actor is cybercrime-motivated,” the BlackBerry Threat Research and Intelligence Team said in a new analysis.

The Canadian cybersecurity company disclosed a spear-phishing campaign aimed at Ukrainian entities to deploy a remote access trojan called RomCom RAT and after a week of the disclosure, the latest findings cane out.

The unknown threat actor has also been observed leveraging trojanized variants of Advanced IP Scanner and pdfFiller as droppers to distribute the implant.

The latest iteration of the campaign entails setting up decoy lookalike websites with a similar domain name, followed by uploading a malware-laced installer bundle of the malicious software, and then sending phishing emails to targeted victims.

“While downloading a free trial from the spoofed SolarWinds site, a legitimate registration form appears,” the researchers explained.

“If filled out, real SolarWinds sales personnel might contact the victim to follow up on the product trial. That technique misleads the victim into believing that the recently downloaded and installed application is completely legitimate.”

The use of RomCom RAT has also been linked to threat actors associated with the Cuba ransomware and Industrial Spy, according to Palo Alto Networks Unit 42, which is tracking the ransomware group under the constellation-themed moniker Tropical Scorpius.

Given the interconnected nature of the cybercriminal ecosystem, it’s not immediately evident if the two sets of activities share any connections or if the malware is offered for sale as a service to other threat actors.