Firefox and Windows zero-days exploited by Russian RomCom hackers

Russian-based RomCom chained two zero-day vulnerabilities (Firefox CVE-2024-9680 and Windows Task Scheduler CVE-2024-49039) to achieve remote code execution and privilege escalation, delivering a RomCom backdoor to victims who visited attacker-controlled sites. ESET telemetry indicates active exploitation against Firefox and Tor Browser users across Europe and North America, affecting organizations in government, defense, energy, pharmaceuticals, and insurance.