Skip to content

CyberSIXT Search

Threat actor

RomCom

Tracked by CyberSIXT since 26 Nov 2025

Articles · all time: 3
Articles · last 30 days: 0
CVEs exploited · attributed · all time: 0
Research reports · all time: 0

Three articles so far, 26 Nov 2025 to 26 Nov 2025.

Wed 26 Nov 2025 · first reportGRU Unit 29155 Uses SocGholish to Target US FirmSecurityOnline
Wed 26 Nov 2025RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent MalwareThe Hacker News
Wed 26 Nov 2025For the first time, a RomCom payload has been observed being distributed via SocGholishSecurity Affairs

See the full timeline

Names and sources

RomCom: Named by CyberSIXT coverage
ba9e1ed2-e142-48d0-a593-f73ac6d59ccd: Named by CyberSIXT coverage

Coverage

3 articles, all timeFull timeline RSS feed

26 Nov 2025For the first time, a RomCom payload has been observed being distributed via SocGholishSecurity Affairs
26 Nov 2025RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent MalwareThe Hacker News
26 Nov 2025GRU Unit 29155 Uses SocGholish to Target US FirmSecurityOnline · first in our coverage