UAT-5647 Unleashes New Malware Arsenal in Targeted Espionage Campaigns

The Russian cybercriminal group UAT-5647 (also known as RomCom) has launched a new wave of cyberattacks targeting Ukrainian government agencies and unidentified Polish entities since late 2023. These attacks involve a new variant of the RomCom RAT, now known as SingleCamper (also referred to as SnipBot or RomCom 5.0). UAT-5647 has also expanded their toolkit to include four distinct malware families, two downloaders identified as RustClaw and MeltingClaw, two backdoors named DustyHammock and ShadyHammock. This evolution of their tools reflects a more sophisticated approach, allowing them to carry out persistent and targeted attacks with greater stealth and complexity.