Nebulous Mantis

Nebulous Mantis is a Russian-speaking, Russia-linked cyber espionage group active since at least mid-2019. It is tracked under multiple aliases including RomCom, Cuba, STORM-0978, Tropical Scorpius, UNC2596, CIGAR, and Void Rabisu. Reporting describes the group as targeting government entities, critical infrastructure, political figures, and NATO-related defense organizations, and as blending espionage activity with ransomware operations. The group initially used the Hancitor loader and pivoted to RomCom RAT in mid-2022. Its operations commonly begin with spear-phishing emails containing malicious links or weaponized documents, including lures impersonating trusted services such as OneDrive and fake PDF downloads. The infection chain includes staged payload delivery, such as Keyprov.dll, followed by RomCom backdoors and a final-stage C++ implant. RomCom uses encrypted command-and-control, living-off-the-land techniques, decentralized infrastructure including IPFS, and persistence via COM hijacking and other registry manipulation. Reported evasion includes anti-sandbox checks, time zone analysis, file renaming, and frequently rotated infrastructure. Post-compromise activity includes credential harvesting, system and network reconnaissance, Active Directory and domain enumeration, lateral movement, and data collection and staging for exfiltration. Reported tooling includes Plink for SSH tunneling, WinRAR for archiving, AD Explorer for domain enumeration, renamed Sysinternals tools, and reverse SSH tunnels. Data exfiltration is conducted over encrypted C2 channels, with archives staged in locations such as C:\Users\Public\Music. Reporting states the group frequently deploys ransomware after exfiltration to obscure espionage activity. Associated ransomware brands include Cuba ransomware, Industrial Spy, and Team Underground. PRODAFT also linked infrastructure procurement and management to an individual tracked as LARVA-290, including use of bulletproof hosting providers such as LuxHost and AEZA.