Microsoft discovers Storm-0978 spying phishing
Microsoft has identified a phishing campaign by Russian threat actor Storm-0978 targeting defense and government agencies in Europe and North America. It's about financial data and espionage in the attack. Storm-0978 (DEV-0978; also referred to by other vendors as RomCom, the name of their backdoor) is a Russia-based cybercriminal group known for conducting opportunistic ransomware and extortion operations, as well as credential-targeting attacks. Storm-0978 operates, develops and distributes the RomCom backdoor. The actor also deploys the underground ransomware, which is closely related to the Industrial Spy ransomware, which first appeared in the wild in May 2022…