ComicForm and SectorJ149 Hackers Deploy Formbook Malware in Eurasian Cyberattacks

A previously undocumented hacking group named ComicForm has been targeting organisations in Belarus, Kazakhstan and Russia since at least April 2025, according to NSHC ThreatRecon Team. The phishing campaign sends emails with Russian or English text and subject lines such as “Waiting for the signed document” or “INvoice for Payment,” delivering a Windows executable that masquerades as a PDF and launches a MechMatrix Pro.dll loader before dropping Montero.dll, which acts as a dropper for the Formbook malware.

The attackers also create scheduled tasks and configure Microsoft Defender exclusions to evade detection, and the phishing pages use JavaScript to harvest credentials by capturing input and transmitting it to an attacker-controlled domain.

In a separate disclosure, NSHC ThreatRecon Team noted a pro-Russian group dubbed SectorJ149 (aka UAC-0050) targeting South Korea, beginning in November 2024, with attacks that used a Visual Basic Script to fetch a loader from Bitbucket or GitHub and ultimately deploy Formbook and Remcos payloads. The activity includes both phishing emails and phishing resources disguised as web services, aimed at gathering credentials from multiple sectors, including manufacturing, energy and financial services.