RomComThreat actor
- Storm-0978
- uat-5647
ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military personnel, government agencies, and political leaders.From MISP Galaxy
Last reported 10 months ago, by Trend Micro Research1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“A scheduled task is then created to launch such process with four arguments at every boot with SYSTEM privileges.”
- T1684Social Engineering
“In November 2025, spear-phishing emails featuring a Trend Micro-themed social engineering lure were sent to various industry verticals – including defense, energy, chemical, cybersecurity (including Trend and a subsidiary), and ICT companies – where a decoy website mimicked Trend…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics“…als, and cybersecurity shared characteristics with older campaigns attributed to Void Rabisu (also known as ROMCOM, Tropical Scorpius, Storm-0978).”
Thanks — we review every report.