New RomCom malware variant 'SnipBot' spotted in data theft attacks

Unit 42 researchers identified SnipBot (RomCom 5.0), a sophisticated backdoor used in phishing-driven campaigns to steal data and pivot across networks. SnipBot extends RomCom with 27 commands for granular data collection and archiving, persists via COM hijacking and signed downloaders, uses in-memory encrypted DLLs and anti-sandbox checks, and performs AD discovery and targeted exfiltration (archiving with WinRAR/7-Zip and exfil via PuTTY SCP); observed targets include IT services, legal, and agriculture sectors.