TA829 and UNK_GreenSec Collaborate in Ongoing Malware Operations
July 1, 2025
Cyber Espionage / Vulnerability
Recently, cybersecurity analysts have identified notable tactical parallels between the malicious activities of two distinct threat actor groups: one associated with the RomCom Remote Access Trojan (RAT) and another linked to a malware loader known as TransferLoader. The enterprise security firm Proofpoint is actively monitoring the operations of TransferLoader, attributing its deployment to a group identified as UNK_GreenSec. Concurrently, the RomCom RAT activities have been traced to a group designated as TA829, which is also recognized by various aliases, including CIGAR, Nebulous Mantis, Storm-0978, Tropical Scorpius, UAC-0180, UAT-5647, UNC2596, and Void Rabisu.
Proofpoint’s investigation into TA829 has revealed a clear overlap in infrastructure and tactics with UNK_GreenSec. The firm noted an “unusual amount of similar infrastructure, delivery tactics, landing pages, and email lure themes,” suggesting a coordinated effort or shared resources between these two actors. This convergence raises concerns about the evolving landscape of cyber threats, particularly given that TA829 is characterized by its dual focus on espionage and financially motivated cyber activities.
TA829 has emerged as a particularly striking player within the cyber threat realm, largely due to its hybrid capabilities. Aligned with Russian cyber interests, this group has been implicated in the exploitation of zero-day vulnerabilities, particularly within widely used software such as Mozilla’s products. Their operations suggest a sophisticated understanding of both offensive tactics and operational security, which may contribute to their effectiveness and longevity in executing various cyber campaigns.
Business entities that may fall victim to these ongoing campaigns are primarily those engaged in sectors of high-value information, particularly technology and defense. The targeting of sensitive data can result not only in immediate financial loss but can also damage reputations and erode customer trust.
In relation to the MITRE ATT&CK framework, various adversary tactics and techniques may have been employed during these attacks. From initial access through phish-based delivery methods to maintaining persistence within compromised networks, the strategies evident in these operations reflect a multi-faceted approach to infiltration and exploitation. Privilege escalation techniques may also be apparent, as both groups aspire to gain higher levels of access once inside a target’s infrastructure.
As businesses navigate this challenging landscape, it is imperative for owners to remain vigilant regarding the evolving threats posed by sophisticated actors like TA829 and UNK_GreenSec. Implementing robust cybersecurity measures, staying informed about the latest vulnerabilities, and fostering a culture of caution among employees can significantly mitigate risks associated with these persistent threats. In conclusion, the tactics of TA829 and UNK_GreenSec underscore the escalating sophistication and collaboration among cyber threat actors, warranting heightened awareness and proactive responses from organizations worldwide.
