Malicious spear-phishing messages have been leveraged by RomCom — also known as Storm-0978, UAC-0180, Void Rabisu, UNC2596, and Tropical Scorpius — to distribute the MeltingClaw or RustyClaw downloaders for the ShadyHammock and DustyHammock backdoors, respectively, with the latter facilitating the delivery of the SingleCamper trojan, according to a report from Cisco Talos. Such intrusions indicate RomCom’s efforts to “establish long-term access and exfiltrate data for as long as possible to support espionage motives, and then potentially pivot to ransomware deployment to disrupt and likely financially gain from the compromise,”

Source: SC Magazine