# Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant **[trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html](https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html)** October 13, 2023 APT & Targeted Attacks Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor. By: Feike Hacquebord, Fernando Merces October 13, 2023 Read time: 9 min (2306 words) Void Rabisu is an intrusion set associated with both financially motivated ransomware [attacks and targeted campaigns on Ukraine and countries supporting Ukraine. Among](https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html) the threat actor’s previous targets were the Ukrainian government and military, their energy and water utility sectors, EU politicians, spokespersons of a certain EU government, and security conference participants. In campaigns conducted in late June and early August 2023, Void Rabisu targeted EU military personnel and political leaders working on gender equality initiatives. Among the notable tools used by Void Rabisu is the ROMCOM backdoor, of which it seems to be the exclusive user. ROMCOM itself has gone through various developments over time, including the implementation of more effective detection evasion techniques. Void Rabisu is one of the clearest examples where we see a mix of the typical tactics, techniques, and procedures (TTPs) used by cybercriminal threat actors and TTPs used by nation-state-sponsored threat actors motivated primarily by espionage goals. For example, Void Rabisu has been signing malware with certificates most likely bought from a third-party service provider that other cybercriminal groups are also using. The threat actor has also employed malicious advertisements on both Google and Bing to generate search engine traffic to their lure sites, which contain malicious copies of software often used by system administrators. Void Rabisu also acts like an advanced persistent threat (APT) actor when it targets [governments and military. In June 2023, Void Rabisu exploited the vulnerability CVE-](https://success.trendmicro.com/dcx/s/solution/000294111) [2023-36884 — still a zero-day vulnerability then — in campaigns using the Ukrainian](https://success.trendmicro.com/dcx/s/solution/000294111) World Congress and the July 2023 NATO summit as lures. The extraordinary geopolitical circumstances surrounding the war in Ukraine drives some of the financialseeking threat actors (including Void Rabisu) toward campaigns motivated by espionage. ----- [As reported by Microsoft, Void Rabisu used a zero-day vulnerability related to CVE-](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36884) [2023-36884 in attacks targeting governments at the end of June 2023. Trend Micro’s](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36884) telemetry further confirms that this campaign targeted the military, government personnel, and politicians in Europe. The payload spread by Void Rabisu during this period differed from the ROMCOM [backdoor we analyzed in an earlier blog entry, but the two have clear similarities. This](https://www.trendmicro.com/en_nl/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html.) indicates that the threat actors are actively developing the ROMCOM backdoor. The next iteration of the malware was used in early August 2023. On or around Aug. 8, 2023, Void Rabisu set up a malicious copy of the official website of the Women Political Leaders (WPL) Summit that was held in Brussels from June 7 to 8, 2023. The final payload was a new version of ROMCOM backdoor that we have dubbed as “ROMCOM [4.0” (also known as PEAPOD).](https://twitter.com/r00tbsd/status/1679042069229191173) Attended by people from all over the world, the WPL summit aims to improve gender equality in politics. Among the topics included in the 2023 Brussels conference were peace and security, war and oppression, disinformation, the war in Ukraine, the role of women in politics, and gender equality. Since many current and future political leaders had attended this conference, it presented an interesting target for espionage campaigns and served as a possible avenue for threat actors to gain an initial foothold in political organizations. It is therefore not surprising that Void Rabisu set up a campaign targeting WPL Summit 2023 attendees. Our telemetry provided concrete evidence that this campaign was aimed at targets working on gender equality in EU politics. In some of its latest campaigns, Void Rabisu started using a new technique that has not previously been reported on. It involves a TLS-enforcing technique by the ROMCOM command-and-control (C&C) servers that can render the automated discovery of ROMCOM infrastructure more difficult. We observed Void Rabisu using this technique in a May 2023 ROMCOM campaign that spread a malicious copy of the legitimate PaperCut software, in which the C&C server ignored requests that were not conformant. This report provides a general background on Void Rabisu and its activities with regard to the recent WPL Summit campaign. We begin by describing how Void Rabisu targeted WPL Summit attendees in the following section. ## The fake WPL Summit 2023 page On Aug. 8, 2023, Void Rabisu actors set up a website called wplsummit[.]com to attract visitors of the legitimate wplsummit.org domain. The fake website (shown in Figure 1) looked exactly like the legitimate one. ----- Figure 1. WPL Summit 2023 fake website While the “Videos & photos” link of the legitimate domain redirects visitors to a Google Drive folder containing photographs from the event, the wplsummit[.]com fake website directed visitors to a OneDrive folder containing two compressed files and an executable called Unpublished Pictures 1-20230802T122531-002-sfx.exe. The latter file appears to be a piece of malware, the binary of which we analyze in the next section. Figure 2. The OneDrive folder containing WPL Summit 2023 pictures and a malware downloader ## Malware analysis User-Agent-Based downloader The executable downloaded from the OneDrive folder is signed by a company called Elbor LLC (which was previously used to sign multiple malicious files) with a valid certificate. When executed, it pretends to be a self-extracting (SFX) archive and extracts 56 pictures from its resource section to a folder when the user selects the “Extract” button: ----- Figure 3. Fake window shown by the malware downloader ----- Figure 4. Pictures dropped by the malware downloader from the event (gathered by the threat actor from various social media postings) The extracted photos were sourced by the malicious actor from individual posts on various social media platforms such as LinkedIn, X (formerly known as Twitter), and Instagram. While the victim is distracted with the pictures, the malware sends an HTTP GET request to https://mctelemetryzone[.]com/favicon.ico. The HTTP User-Agent string is checked on the server side, and if it matches the following string, a 122-KB file is downloaded:+ “Mozilla/5.0 (Windows NT 10.0; Win64; x64; Xbox; Xbox One) AppleWebKit/537.36 _(KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edge/44.18363.8131”_ The file is an XOR-encrypted PE file: ----- Figure 5. XOR-encrypted, second stage payload The downloaded file can be decrypted with the following pseudocode: _for (i=0; i