According to the BlackBerry Threat Research and Intelligence team, RomCom, a threat actor, is likely behind two cyber-attack attempts targeting supporters of Ukraine, including guests of the current NATO Summit.

The team at BlackBerry found that two malicious documents were sent in an attempt to scam supporters of Ukraine abroad and NATO members, with the lures being sent from an IP address in Hungary.

They said it was likely RomCom based on the “tactics, techniques, and procedures (TTPS)” of the attempted attack, as well as the code similarity and the network infrastructure.

Currently, Lithuania is hosting a NATO Summit in Vilnius, which will discuss the future of support for Ukraine and it’s potential membership in the organisation.

The threat actors have taken advantage of this by impersonating the Ukrainian World Congress and distributing a malicious document to supporters.

According to BlackBerry’s investigation, the threat actors are using RFT exploitation, using outbound connections that are initiated once the victim opens the document.

The security team identified another document from the same threat actor was likely sent in relation to the NATO summit, lobbying to support Ukraine’s membership. It had the same RFT exploitation tactic.

While the attack vector has not yet been uncovered, BlackBerry says it was likley a spear-phishing technique.

The actors created a malicious duplicate of the Ukrainian World Congress website, using a .info suffix in replacement of the real .org website.

RomCom has used this technique before, according to BlackBerry’s report.

The document sent to supporters contained an embedded RTF file with the name afchunk.rtf. Once the document is downloaded and opened, the RFT loads an OLE object, which connects to IP addresses related to VPN/proxy services.

Another file is loaded after the execution of the initial lure – this file then aims to load the OLE streams into Microsoft Word, with a goal of creating an iframe tag responsible for the next step.

The main attack goal is to execute a chain which exploits a zero-day vulnerability in Microsoft’s Support Diagnostic Tool (MSDT), known as Follina.

According to the report, if exploited, the threat actors can conduct a remote code execution (RCE) attack by creating a malicious .docx or .rft document.

Threat actors can accomplish this by leveraging the document to execute a vulnerable MSDT version, which would allow the attacker to authorise the utility for execution.

Recommended

• How Has One of Scotland’s Most Influential Tech Investors Evolved?
• Meta’s Threads Hits 100 Million Users in Five Days
• Orbex Expands Facilities Ahead of UK Vertical Rocket Launch

Finally, the attack is completed when the RomCom backdoor is loaded on the machine.

RomCom has not been confirmed as the attacker, but BlackBerry suggests the attack methodology is similar to past attacks by the organisation.

Malware from RomCom was first discovered in August 2022, and was linked to a Cuba Ransomware affiliate.

In November 2022, however, a new RomCom campaign was discovered, which used fake sites in English and Ukrainian and abused software brands to target victims.