Listen to this Post
Cybersecurity threats are growing increasingly sophisticated, and among the most concerning are the operations conducted by groups like Nebulous Mantis. Operating since 2019, this Russian-speaking cyber espionage group has targeted critical infrastructure, governments, and NATO-linked entities using a variety of advanced techniques. With its tools of choice being the RomCom RAT and Hancitor malware, Nebulous Mantis has evolved its strategies over the years to launch multi-phased, highly evasive attacks, all aimed at stealing sensitive data and maintaining long-term access to compromised systems. This article explores the group’s tactics, their use of RomCom malware, and the continuing evolution of their operations.
The Rise of Nebulous Mantis and RomCom RAT
Nebulous Mantis, also known by other aliases like Cuba, STORM-0978, and Tropical Scorpius, has been a constant threat in the world of cyber espionage. They have consistently used RomCom, a Remote Access Trojan (RAT), as their primary tool for espionage. This RAT, which has been linked to spear-phishing campaigns, allows attackers to perform a range of activities including lateral movement, data theft, and persistence on targeted networks.
Since mid-2022, RomCom has become the main weapon in the Nebulous Mantis arsenal. They deliver the malware primarily through spear-phishing emails, which often mimic legitimate services such as OneDrive to deceive victims. Once the victim downloads an infected file, the malware initiates a multi-step attack that includes privilege escalation, system profiling, and credential harvesting. The attackers then exfiltrate the stolen data to their command and control (C2) servers, often through encrypted communication channels to evade detection.
One of the key characteristics of Nebulous Mantis’s operations is their focus on evasion. RomCom is equipped with advanced techniques to avoid detection, such as living-off-the-land (LOTL) tactics and encrypted C2 communications. These evasive methods allow the attackers to maintain their presence within the target network for extended periods while avoiding the attention of security tools and researchers.
The Multi-Stage Attack Lifecycle
Nebulous Mantis’s attack strategies are highly organized, with each phase serving a distinct purpose in the overall attack. After the initial compromise through spear-phishing, the attackers use RomCom to perform a range of malicious activities:
- Initial Access and Exploitation: Once the victim opens the malicious file, RomCom initiates and begins checking for signs of sandbox environments or virtual machines to avoid detection.
-
Privilege Escalation and Lateral Movement: After successfully gaining access, the attackers use various tools like Sysinternals and renamed WinRAR to escalate privileges and move laterally across the network. These tools help the attackers move undetected, blending in with normal system activities.
-
Credential Harvesting and Data Exfiltration: The attackers collect sensitive credentials and data, typically from critical directories such as c:\users\public\music, which are then exfiltrated to the attackers’ C2 servers.
-
Maintaining Persistence: To maintain long-term access, the group manipulates the system registry and uses reverse SSH tunnels. This ensures that even if some components of the attack are discovered, the attackers can still maintain access and deploy further payloads.
-
Ransomware Deployment: After gathering critical information, Nebulous Mantis deploys ransomware to encrypt the stolen data and demands a ransom. Initially, the group used Cuba ransomware, but by 2022, they switched to using Industrial Spy ransomware, and later Team Underground ransomware, in a very similar manner.
The Technical Sophistication of RomCom RAT
RomCom is not just another RAT; its technical sophistication makes it a formidable tool in cyber espionage. Key to its effectiveness is its ability to evade detection, even when employed against high-profile targets like NATO-related entities and governmental agencies. The RAT uses modular malware, which makes it adaptable to various environments. It can download additional payloads as needed, and its use of bulletproof hosting services ensures that the attackers can stay one step ahead of defenders by frequently changing their C2 infrastructure.
RomCom’s ability to operate covertly and perform multi-stage attacks is what sets it apart from other malware. The attackers not only use RomCom for system profiling and credential harvesting but also employ a variety of tools, including Plink and WinRAR, to conduct lateral movement and further exfiltrate data. The malware’s persistence tactics, combined with its ability to evade detection, make it a significant cybersecurity threat to critical infrastructure and government organizations worldwide.
What Undercode Says: A Deeper Analysis of Nebulous Mantis’s Operations
When examining Nebulous Mantis’s operations, it becomes clear that their ability to adapt and evolve is a central component of their ongoing success. Unlike many cybercriminal groups that focus on quick financial gain, Nebulous Mantis seems to have a longer-term goal of gathering intelligence and causing geopolitical disruption. Their use of spear-phishing and RomCom malware shows a deep understanding of human psychology, leveraging trust to gain initial access and then using sophisticated tactics to maintain persistence.
The
Another striking aspect of Nebulous Mantis is their continual evolution. The group started by using Cuba ransomware, transitioned to Industrial Spy, and now employs Team Underground ransomware in their attacks. This ongoing change in tactics demonstrates the group’s resilience and adaptability. They are not only able to execute highly complex cyber espionage operations but are also constantly refining their methods to stay ahead of defenders.
Fact Checker Results
- RomCom RAT’s Sophistication: The use of encrypted communications and LOTL tactics indicates that RomCom is a highly advanced piece of malware designed to evade detection and persist within target systems for long durations.
-
Bulletproof Hosting Services: The reliance on bulletproof hosting services like LuxHost and AEZA is consistent with the behavior of advanced threat groups that need to maintain their C2 infrastructure without interference from law enforcement or cybersecurity professionals.
-
Ransomware Evolution: The shift from Cuba to Industrial Spy and finally to Team Underground ransomware suggests that Nebulous Mantis is not only evolving in terms of its malware toolkit but also in terms of their operational goals, likely to avoid detection and maximize impact.
Prediction
As cyber threats continue to evolve, it’s likely that Nebulous Mantis will further refine their tactics and techniques, potentially incorporating new attack vectors and malware strains into their arsenal. Given their operational security and focus on critical infrastructure, it’s plausible that the group may begin to target more private sector companies or expand their operations into other regions. Additionally, the group’s continued use of spear-phishing and modular malware suggests that they will remain a significant threat for the foreseeable future, especially to high-value targets within the governmental and defense sectors. Their focus on espionage over financial gain may lead to more sophisticated, long-term operations designed to gather sensitive information and disrupt critical operations.
References:
Reported By: securityaffairs.com
Extra Source Hub:
https://www.discord.com
Wikipedia
Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
