Inside Snip Bot: The Latest Rom Com Malware Variant
Summary: Unit 42 documented SnipBot, a new RomCom variant it designates version 5.0, first found in its Advanced WildFire sandbox in early April and also identified by Sophos in February during an incident. The initial downloader is a signed executable disguised as a PDF, delivered via email links through attacker-registered domains such as fastshare[.]click and docstorage[.]link, and it leads to a DLL injected into Explorer through COM hijacking and a backdoor that listens on port 1342 for commands.
Bottom line: The downloader carried a valid code signing certificate, reportedly from a Danish company, while every later module was unsigned - so a certificate check clears the first stage of an intrusion that then pivots through the network and exfiltrates files.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026