RussiaAssessedGRU Unit 29155MixedActive 2022 – 2025RomCom
Also known asStorm-0978 · Void Rabisu · DEV-0978 · CIGAR · UAC-0180 · TA829 · UAT-5647
Summary
Russia-aligned group that mixes financially motivated ransomware operations with espionage against Ukraine, NATO members and their defence, government and critical-infrastructure organisations. Oct–Nov 2024: chained Firefox CVE-2024-9680 and Windows CVE-2024-49039 zero-days for zero-click compromise (ESET). Jul 2025: exploited the WinRAR zero-day CVE-2025-8088 in résumé-themed spearphishing against financial, manufacturing, defence and logistics firms in Europe and Canada (ESET). Sep 2025: SocGholish fake updates delivering a Mythic agent to a US civil-engineering firm, which Arctic Wolf assesses (medium–high confidence) as GRU unit 29155 using RomCom. ESET's Oct 2025–Mar 2026 report has no new RomCom operation; last confirmed activity is 2025. Attribution split: Unit 42 folds the Cuba-ransomware operator (Tropical Scorpius / UNC2596) into this actor, while Microsoft, which coined both Storm numbers, tracks it separately as Storm-0671 and lists RomCom as Storm-0978 (with Underground ransomware); this record follows the originator and does not equate them.
Attribution
Single-vendor assessment, medium-to-high confidence
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Arctic Wolf Labs (Research, 2025-11-25)
Medium-to-high confidence that GRU Unit 29155 uses SocGholish to deliver RomCom payloads
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| SocGholish fake updates → RomCom Mythic loader (US civil-engineering firm) | 2025-09 | USA | Engineering | Arctic Wolf Labs (2025-11-25) |
| WinRAR zero-day CVE-2025-8088 résumé spearphishing | 2025-07 | Europe, Canada | Financial Services, Manufacturing, Defense, Logistics | ESET Research (2025-08-11) |
| Operation Deceptive ProspectASSESSED | 2025-03 | UK | Retail, Hospitality, Critical Infrastructure | Bridewell (2025-04-29) |
| Zero-Day Chaining Campaign | 2024-10 – 2024-11 | Europe, North America | Government, Defence, Healthcare | ESET Research (2024-11-26) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Initial Access3 | T1566.001Spearphishing AttachmentT1190Exploit Public-Facing ApplicationT1189Drive-by Compromise |
|---|---|
| Execution1 | T1059.001PowerShell |
| Impact1 | T1486Data Encrypted for Impact |
Malware and tools 6
| Name | Description | Platform |
|---|---|---|
| RomCom RAT | Modular Backdoor | Windows |
| PEAPOD | Backdoor | Windows |
| SnipBot | Multi-stage Backdoor | Windows |
| RustyClaw | Downloader | Windows |
| VIPERTUNNEL | Python backdoor | Windows |
| Mythic agent (custom loader) | Open-source C2 agent | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2024-9680 | 9.8 | Mozilla Firefox — animation timeline use-after-free, 0-day (KEV 2024-10-15) |
| CVE-2024-49039 | 8.8 | Microsoft Windows Task Scheduler — privilege escalation, 0-day (KEV 2024-11-12) |
| CVE-2025-8088 | 8.4 | RARLAB WinRAR — path traversal via alternate data streams (KEV 2025-08-12) |
| CVE-2023-36884 | 7.5 | Microsoft Office / Windows Search — RCE via crafted Office documents (KEV 2023-07-17) |
Highest CVSS first.
Infrastructure patterns
- Own VPSes and bought domains; lookalike "redir"/"red" servers redirect to its exploits (ESET, 2024)