{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/romcom/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Storm-0978","RomCom","Tropical Scorpius"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["persistence","privilege-escalation","windows","com-hijacking"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eThe RomCom threat actor has been observed utilizing COM hijacking to achieve persistence on compromised Windows systems. The attack involves modifying the InProcServer32 subkey for the PSFactoryBuffer CLSID ({c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}), which is normally associated with ActXPrxy.dll. By replacing the default value with a path to a malicious DLL, attackers ensure their code is loaded by processes that initialize this COM object.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of code within the context of any process that loads the hijacked COM object, facilitating persistence.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for unauthorized modifications to the PSFactoryBuffer registry key.\u003c/li\u003e\n\u003cli\u003eBaseline legitimate registry values for InProcServer32 to identify deviations from the standard ActXPrxy.dll paths.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-13T06:51:58Z","date_published":"2026-11-13T06:51:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-psfactorybuffer-com-hijack/","summary":"The RomCom threat actor uses COM hijacking of the PSFactoryBuffer CLSID to establish persistence by redirecting execution to a malicious DLL via the InProcServer32 registry key.","title":"PSFactoryBuffer COM InProcServer32 Registry Hijacking","url":"https://feed.craftedsignal.io/briefs/2026-11-psfactorybuffer-com-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - RomCom","version":"https://jsonfeed.org/version/1.1"}