Nebulous Mantis Targets NATO-Linked Entities with Multi-Stage Malware Attacks
Researchers studying cybersecurity have revealed that Nebulous Mantis, a Russian-speaking cyber espionage gang, has been using the RomCom RAT remote access virus since the middle of 2022.
In a report shared with The Hacker News, Swiss cybersecurity firm PRODAFT stated that RomCom uses sophisticated evasion strategies, such as encrypted command and control (C2) communications and living-off-the-land (LOTL) tactics, while constantly upgrading its infrastructure. The company also uses bulletproof hosting to stay persistent and avoid detection.
Nebulous Mantis is known to target government agencies, political figures, NATO-affiliated defense organizations, and key infrastructure. The cybersecurity community also tracks it under the names CIGAR, Cuba, Storm-0978, Tropical Scorpius, UNC25...