TA829 Hackers Deploy New TTPs and Upgraded RomCom Backdoor to Bypass Detection

**Executive summary:** The report details TA829’s evolving operations that blend espionage and financially motivated cybercrime, highlighting upgraded RomCom-derived backdoors (SingleCamper/DustyHammock), advanced loaders (SlipScreen, TransferLoader), phishing via compromised MikroTik routers and freemail, infrastructure overlap with UNK_GreenSec, and multiple first-stage domains and IOCs linked to campaigns delivering ransomware and other payloads.