Potential RomCom group post-exploitation attempts

Bas tradamus@Bastradamus

•updated Nov 3, 2025•25•1•296

Detecting post-exploitation attempts based on RomCom group adversary activity and the following malware/backdoor signatures: Mythic agent, SnipBot and MeltingClaw. Based on the following threat reports after the WinRAR CVE-2025–8088 exploitation. 1. ESET: https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ 2. Talos: https://blog.talosintelligence.com/uat-5647-romcom/