Ethical Hacking News

Russia's RomCom Malware Family Exploits SocGholish Fake Update Attacks to Deliver Mythic Agent

Russia's RomCom malware family has employed the SocGholish fake update attacks to deliver the Mythic Agent, with Arctic Wolf Labs attributing the activity with medium-to-high confidence to Unit 29155 of Russia's Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). This sophisticated attack utilizes a range of tactics, including spear-phishing and zero-day exploits, to breach target networks and drop malware payloads. The development serves as a stark reminder of the evolving nature of modern threats and the importance of maintaining robust security measures.

The threat landscape has witnessed a sophisticated attack by Russia's Unit 29155, utilizing SocGholish fake update attacks to deliver the Mythic Agent malware family.

The attack used JavaScript loader dubbed SocGholish, linked to financially motivated operator TA569 (aka Gold Prelude, Mustard Tempest, etc.), as an initial access broker.

The SocGholish attack chain involves serving fake browser update alerts for Google Chrome or Mozilla Firefox on compromised websites.

The RomCom payload leverages methods to breach target networks and drop a remote access trojan (RAT) on victim machines.

The attack ultimately proved unsuccessful, but highlights the RomCom threat actor's continued interest in targeting Ukraine or entities providing assistance to the country.

The SocGholish attacks are a potent threat to organizations worldwide due to their speed and efficiency.

The threat landscape has witnessed yet another sophisticated and far-reaching attack by Russia's Unit 29155, a.k.a. GRU, which utilized the SocGholish fake update attacks to deliver the Mythic Agent malware family. This particular brand of cyber warfare, dubbed "RomCom" or "Nebulous Mantis," has been recognized for its ability to infiltrate organizations in Ukraine and NATO-related defense organizations.

The attack began with a JavaScript loader dubbed SocGholish, which was linked to a financially motivated operator tracked as TA569 (aka Gold Prelude, Mustard Tempest, Purple Vallhund, and UNC1543). This initial access broker allows other threat actors to drop a wide range of payloads, making it an attractive option for adversaries seeking to expand their malware toolkit. The SocGholish attack chain typically involves serving fake browser update alerts for Google Chrome or Mozilla Firefox on legitimate-but-compromised websites, tricking unsuspecting users into downloading malicious JavaScript that's responsible for installing the loader.

Once inside, the SocGholish loader is replaced with a RomCom payload, which leverages several methods to breach target networks and drop the eponymous remote access trojan (RAT) on victim machines. The threat actor has been known to dabble in both cybercrime and espionage operations since at least 2022.

The attack analyzed by Arctic Wolf Labs revealed that the fake update payload allows the threat actors to run commands on the compromised machine by means of a reverse shell established to a command-and-control (C2) server. This included conducting reconnaissance and dropping a custom Python backdoor codenamed VIPERTUNNEL. Another delivered component was a RomCom-linked DLL loader, which launches the Mythic Agent – a crucial component of the cross-platform, post-exploit, red teaming framework that communicates with a corresponding server to support command execution, file operations, and others.

While the attack ultimately proved unsuccessful and was blocked before it could progress any further, the development demonstrates the RomCom threat actor's continued interest in targeting Ukraine or entities providing assistance to the country, regardless of how tenuous their connection may be. The widespread nature of SocGholish attacks and the relative speed at which the attack progresses from initial access to infection make it a potent threat to organizations worldwide.

The timeline from infection via [the fake update] to the delivery of RomCom's loader was less than 30 minutes, according to Jacob Faires, an Arctic Wolf Labs researcher. Delivery is not made until the target's Active Directory domain has been verified to match a known value provided by the threat actor. The speed and efficiency with which SocGholish attacks can be executed serve as a stark reminder of the importance of maintaining robust security measures.

The SocGholish (aka FakeUpdates) served as an initial access broker, linking to a financially motivated operator tracked as TA569 (aka Gold Prelude, Mustard Tempest, Purple Vallhund, and UNC1543). This operator has been previously linked to various threat actors, including Evil Corp, LockBit, Dridex, and Raspberry Robin. The attacker also leverages other initial access brokers like the ones utilized by groups such as APT41.

In addition to SocGholish, Arctic Wolf Labs researchers observed that attacks single out websites that are poorly secured, taking advantage of known security vulnerabilities in plugins to inject JavaScript code designed to display pop-up alerts and activate the infection chain. The attackers often target sites with known security vulnerabilities, allowing them to bypass security controls and inject malicious content.

This particular brand of cyber warfare has garnered significant attention due to its ability to infiltrate organizations in Ukraine and NATO-related defense organizations. The threat actor's use of spear-phishing and zero-day exploits serves as a stark reminder of the evolving nature of modern threats.

The attack was ultimately unsuccessful and was blocked before it could progress any further, but the development highlights the RomCom threat actor's continued interest in targeting Ukraine or entities providing assistance to the country, no matter how tenuous their connection may be. The widespread nature of SocGholish attacks and the relative speed at which the attack progresses from initial access to infection make it a potent threat to organizations worldwide.

Related Information:

https://www.ethicalhackingnews.com/articles/Russias-RomCom-Malware-Family-Exploits-SocGholish-Fake-Update-Attacks-to-Deliver-Mythic-Agent-ehn.shtml

https://thehackernews.com/2025/11/romcom-uses-socgholish-fake-update.html

https://cybersixt.com/a/Vor5i66vZ1lUjNNPWg_B7T

https://securelist.com/loki-agent-for-mythic/113596/

https://attack.mitre.org/groups/G1020/

https://malpedia.caad.fkie.fraunhofer.de/actor/mustard_tempest

https://www.hhs.gov/sites/default/files/evil-corp-threat-profile.pdf

https://dailysecurityreview.com/resources/threat-actors-resources/evil-corp-unc2165-the-russian-syndicate-behind-global-cyber-chaos/

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

https://en.wikipedia.org/wiki/LockBit

https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-339a

https://en.wikipedia.org/wiki/Dridex