Tag: ta569

1 Attack Reports | 0 Vulnerabilities

Attack reports

Russian RomCom Utilizing SocGholish to Deliver Mythic Agent to U.S. Companies Supporting Ukraine

Arctic Wolf Labs identified a U.S.-based company targeted by the Russian-aligned threat group RomCom via SocGholish, operated by TA569. This marks the first observed instance of a RomCom payload being distributed through SocGholish. The attack chain involved compromising legitimate websites, using …
malvertising
ukraine
socgholish
fakeupdate
gru
2025-11-25
ta569
mythic agent
vipertunnel
Published: November 25, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports