GRU Unit 29155 Uses SocGholish to Target US Firm

Arctic Wolf Labs has reported a cyber threat campaign involving the financially motivated threat actor TA569, known for using SocGholish malware, in collaboration with the Russian state-backed group RomCom. This marks a significant evolution in cyber threats, combining opportunistic e-crime with military espionage. The investigation focuses on a September 2025 attack on a U.S. civil engineering firm, initiated through a fake Chrome browser update.

The attack involved a sophisticated infection chain, including initial access via malvertising, a technical handoff to a loader, target verification, and deployment of the Mythic Agent for command and control. The attackers aimed at entities with ties to Ukraine, leveraging SocGholish to mask their operations within common cybercrime activities.