RomCom Malware Group Targets U.S. Engineering Firm Using Fake Browser Updates
RomCom, a malware group with ties to Russia, recently went after a U.S. civil engineering firm. They used a JavaScript loader called SocGholish to deliver their Mythic Agent. Arctic Wolf Labs’ Jacob Faires noted that this is the first time anyone has seen SocGholish spreading a RomCom payload.
Researchers connect this attack to Unit 29155, part of Russia’s GRU, and they’re pretty confident about it. The company targeted had previously worked with a city closely connected to Ukraine.
What Is SocGholish?
SocGholish, also known as FakeUpdates, serves as an initial access broker. Essentially, it opens the door for other hackers to deploy any malware they choose. This tool has been linked to TA569, a financially-driven group with a whole bunch of aliases: Gold Prelude, Mustard Tempest, Purple Vallhund, and UNC1543. Their malware delivery service has some big-name customers, Evil Corp, LockBit, Dridex, and Raspberry Robin.
Here’s how it works: attackers compromise legitimate websites, then use them to show fake browser update prompts, such as Chrome or Firefox. Unsuspecting users download what looks like a normal update, but it’s really malicious JavaScript. That script installs a loader, which then grabs more malware. Most of the time, attackers go after poorly secured sites, exploiting known plugin flaws to inject their code and kick off the infection.
RomCom itself (also known as Nebulous Mantis, Storm-0978, Tropical Scorpius, UNC2596, or Void Rabisu) is a Russia-aligned group that’s been mixing cybercrime with espionage since at least 2022. They use spear-phishing, zero-day exploits, and more to break into networks and drop their own remote access trojan (RAT). Their targets? Organizations in Ukraine and NATO’s defense sector.
In the attack Arctic Wolf analyzed, the fake browser update lets the hackers run commands on the compromised computer by setting up a reverse shell to their command-and-control server. They use that access for recon and to plant a custom Python backdoor called VIPERTUNNEL.
The attackers also dropped a RomCom-linked DLL loader that launches the Mythic Agent, an essential part of a cross-platform, post-exploit red teaming toolkit. This agent communicates with its servers and handles things like executing commands and moving files.
Even though the attack wasn’t successful and was quickly stopped, it’s another sign that the RomCom group isn’t giving up. They’re still pursuing Ukraine, and anyone trying to help, even if the connection is very weak.
SocGholish attacks are everywhere, and they happen quickly. This rapid leap from first access to full infection makes it a real threat to organizations worldwide.
Frequently Asked Questions (FAQs)
RomCom is a cyber group linked to Russia. They engage in both cybercrime and espionage. Their method is straightforward; they use spear-phishing, zero-day exploits, and advanced malware to penetrate systems. RomCom often targets organizations affiliated with Ukraine and NATO.
SocGholish is a JavaScript-based malware loader. It presents fake browser updates to users as malware. Once installed, it also allows other hacker groups to install more malware.
Hackers showed a fake browser update to an American engineering firm. As soon as the firm clicked “Update,” the loader was installed on their system. RomCom’s Mythic Agent and a Python-based backdoor (VIPERTUNNEL) were also added.
Yes, SocGholish attacks are now spreading rapidly. They can rapidly damage networks, and therefore, they pose a significant threat to organizations.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!