RomCom RAT Using Deceptive Web of Rogue Software Sites for Covert Attacks

The threat actors behind RomCom RAT are leveraging a network of fake websites advertising rogue versions of popular software at least since July 2022 to infiltrate targets.
Cybersecurity firm Trend Micro is tracking the activity cluster under the name Void Rabisu, which is also known as Tropical Scorpius (Unit 42) and UNC2596 (Mandiant).
"These lure sites are most likely only meant for a small

advertising attacks cluster covert cybersecurity fake july july 2022 micro name network popular rat rogue romcom romcom rat software threat threat actors tracking trend trend micro tropical scorpius under void rabisu web websites