RomCom Threat Group Activity Detection

R W@shiftyroot

•updated Aug 14, 2025•3•0•111

This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.