RomCom Leverages Dual Zero-Day Exploits in Widespread Campaign

The Russia-based RomCom cybercrime group has been observed leveraging two zero-day vulnerabilities in a sophisticated attack chain targeting Firefox and Tor Browser users across Europe and North America. These vulnerabilities were exploited to deploy their signature malware, the RomCom backdoor, onto victims’ systems. By crafting a seamless zero-day exploit chain, the group achieved remote code execution without any need for user interaction. Victims were compromised simply by visiting attacker-controlled websites specifically designed to deliver the malicious payload.