RomCom Malware Resurfaces With SnipBot Variant

SnipBot (RomCom v5) is a new variant of the RomCom RAT observed since December; it spreads via phishing PDFs or executables, uses valid code-signing certificates for the downloader, employs control-flow obfuscation and anti-sandbox checks, and supports command execution, module download, and exfiltration to attacker-controlled servers. Unit 42 links the actor to prior RomCom activity (including attacks on Ukraine and its supporters) and notes the group's shift from financially motivated operations toward exclusive intelligence-gathering.