Security Resilience

Threat actor · all actors

RomComMISP-ba9e1ed2 state

🇷🇺 RU

aka RomCom, Storm-0978, UAT-5647

Last updated: 2026-10-16

2attributed CVEs
0ATT&CK techniques
4.5IDF score (tooling uniqueness)
0exclusive CVEs
2020–2022years active

About this actor

ROMCOM is an evolving and sophisticated threat actor group that has been using the malware tool ROMCOM for espionage and financially motivated attacks. They have targeted organizations in Ukraine and NATO countries, including military personnel, government agencies, and political leaders. The ROMCOM backdoor is capable of stealing sensitive information and deploying other malware, showcasing the group's adaptability and growing sophistication.

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

Microsoftweather-system names

Storm-0978

Unclassifiedno scheme matched

RomComUAT-5647

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2020: 1 CVE published120202021: 1 KEV added120212022: 1 CVE published2022: 1 KEV added22022
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2022-24521 KEV8.57.80.08682022-04-15see CVE
CVE-2020-1472 KEV7.55.50.99512020-08-17see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same nation-state

Same category