Skip to content
Threat Feed
Subscribe

Actor

RomCom

1 brief RSS
Also known as: Storm-0978 Tropical Scorpius
high threat

PSFactoryBuffer COM InProcServer32 Registry Hijacking

The RomCom threat actor uses COM hijacking of the PSFactoryBuffer CLSID to establish persistence by redirecting execution to a malicious DLL via the InProcServer32 registry key.

Storm-0978 +2 persistence privilege-escalation windows com-hijacking
1r 1t