Threat Spotlight: Rombertik - Gazing Past the Smoke, Mirrors, and Trap Doors
Summary: Cisco Talos reverse engineered a malware sample it calls Rombertik, which hooks Firefox, Chrome, or Internet Explorer to capture plain-text credentials before HTTPS encryption and sends them Base64-encoded over unencrypted HTTP to www.centozos.org.in/don1/gate.php. The packed sample is 1264KB against 28KB unpacked, with over 97% of the packed file made up of 75 images and more than 8000 unused functions, and if its anti-analysis checks fail it overwrites the Master Boot Record of PhysicalDisk0 or encrypts every file in the user's home folder with a random RC4 key, then restarts the machine.
What you should know: This is malware built to punish analysis: a failed check leaves the overwritten MBR printing "Carbon crack attempt, failed" in an infinite loop and the partition bytes nulled, so recovery means reinstalling the operating system. Rombertik also stalls by writing a byte of random data to memory 960 million times, a log that would exceed 100 gigabytes and take over 25 minutes to write to a typical hard drive, which is the cost any sandbox or tracing tool inherits when it touches this sample.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026