Cybersecurity researchers have recently uncovered a Russian-speaking cyber espionage group known as Nebulous Mantis. This group has been using a remote access trojan called RomCom RAT since mid-2022. The trojan employs advanced evasion techniques and encrypted command and control communications, making it difficult to detect. Nebulous Mantis has been linked to various other names in the cybersecurity community and is known to target critical infrastructure, government agencies, political leaders, and NATO-related defense organizations.
The group’s attack chains typically involve spear-phishing emails with weaponized document links to distribute the RomCom RAT. They use bulletproof hosting services to host domains and command-and-control servers, with the infrastructure managed by a threat actor known as LARVA-290. This threat actor has been active since at least mid-2019, initially distributing a malware loader codenamed Hancitor.
The RomCom RAT is designed to connect to a command-and-control server, download additional payloads, and execute various commands on infected hosts. It establishes communications with the server to run commands, download additional modules, and steal web browser data. The threat actor behind Nebulous Mantis is highly sophisticated, employing a multi-phase intrusion methodology to gain access, maintain persistence, and exfiltrate data.
In a separate discovery, cybersecurity company PRODAFT recently exposed a ransomware group called Ruthless Mantis. Led by a threat actor named LARVA-127, this group specializes in double extortion by collaborating with affiliate programs. Ruthless Mantis uses a variety of legitimate and custom tools throughout the attack cycle to enhance their operations. They actively integrate newcomers to improve operational efficiency and effectiveness.
Both Nebulous Mantis and Ruthless Mantis demonstrate a high level of operational discipline and sophistication in their cyber activities. These groups highlight the ongoing challenges posed by advanced cyber threat actors and the need for robust cybersecurity measures to protect against such threats.
Source link