SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics

In November, a targeted spear-phishing campaign was observed using Trend Micro-themed lures against various industries, but this was quickly detected and thwarted by the Trend Vision One™ platform.

By: Daniel Lunghi, Ian Kenefick, Feike Hacquebord Dec 11, 2025 Read time: ( words)

Special thanks to Stephen Hilt.

In October and November 2025, campaigns targeting sectors such as energy, defence, pharmaceuticals, and cybersecurity shared characteristics with older campaigns attributed to Void Rabisu (also known as ROMCOM, Tropical Scorpius, Storm-0978). Void Rabisu is known to be associated with an actor group that has both financial and espionage motivations that are aligned with Russian interests. We are tracking these campaigns under a separate, temporary intrusion set, SHADOW-VOID-042, pending further data to support high-confidence attribution.

In the November 2025 campaign, Trend Micro itself, a subsidiary, a partner, and other industries were targeted with a Trend-themed social engineering lure. This lure urged users to install a fake update for alleged security issues in Trend Micro Apex One™ (Figure 1). However, the campaign was thwarted early by Trend Vision One™. During lab testing, an old 2018 Chrome exploit was detected, but more recent exploits were likely used during the actual campaign, though they did not appear in Trend’s telemetry due to the early interception by Trend Vision One.

The subjects of the e-mails in the November 2025 campaign included:

Targets included executives and upper management in sectors like cybersecurity, energy, IT, and logistics. The targeting was carefully done by the actor, but the campaign was halted early in the infection chain: Trend Vision One detected and quarantined most spear phishing emails and blocked landing pages, preventing exposure to exploits and malware further down the kill chain.

A campaign in October 2025 involving the SHADOW-VOID-042 intrusion set targeted several executives and key human resources (HR) employees belonging to various industries with alleged harassment complaints as a social engineering lure. Other social engineering lures included a request to join academic research or to fill in a questionnaire on a work-related topic.

The HR complaints are hard to ignore by the targets, as legitimate complaints might be sent from whistleblowers who prefer to stay anonymous. That is why HR-related lures and job applications are popular tools for social engineering by malicious actors.

Some of the subject lines are listed below:

This campaign used tailored decoy documents or Google forms like a questionnaire or a specification document of a product for the energy sector. Some of the decoy documents meant only for specific targeted companies are listed below in Figure 2.

We found that the October 2025 and November 2025 campaigns have a significant overlap in terms of the attackers’ infrastructure, as well as the tactics, techniques, and procedures (TTPs) that were used.

After clicking on the link, the target gets redirected multiple times and ends on an HTML page impersonating CloudFlare (Figure 3).

In the background, three different JavaScript files get loaded (Figure 4).

We could only retrieve one of those JavaScript files. It contains code exploiting Chrome vulnerability CVE-2018-6065 (Figure 5). The vulnerability has been patched in Chrome version 65.0.3325.146 issued in March 2018.

We could not retrieve the two other JavaScript files. It is likely that they include code for exploiting more recent vulnerabilities. It is possible that these more recent exploits were used against selected targets only. Another possibility is that the campaign targeted a specific application that is built on top of an old version of Chromium.

However, this is not consistent with the targeting that was observed in Trend’s telemetry. Still, the exploit contained snippets from an old exploit that was used to target WeChat, which has a component derived from Chromium. We don’t know if this was intended to mislead researchers, or the result of the attacker copying and pasting from public sources.

In case the vulnerability exploitation fails, the target is redirected to a decoy website of a company called TDMSEC, as shown in Figure 6. The look and feel of this website mimics the corporate style of Trend’s website to a certain extent, and this is likely intentional.

The Javascript file contained a hardcoded 64-bits shellcode (Figure 7). It calls some Windows APIs using a custom API hashing algorithm, with the 0x5010101010101203 value as a seed.

It generates a custom ID based on the following information:

Such unique ID is encrypted with a randomly generated 8-byte AES CBC encryption key. The result is sent to a first C&C server through an HTTPS request starting with “get_module_hello”.

The C&C server answers with an encrypted binary that is decrypted and written to hardcoded filepath C:\ProgramData\Microsoft\Windows\SystemProcessHost.exe, which we will call Stage 2. A scheduled task is then created to launch such process with four arguments at every boot with SYSTEM privileges.

This file is a simple loader for code embedded inside it that is encrypted with the SHA512 of the unique ID generated by the shellcode. This means that the file returned by the C&C in the stage is already customised to the targeted machine. Without the information used to generate the custom ID, it is not possible to decrypt the embedded code.

The file also uses a modified version of the custom API hashing algorithm seen in the shellcode analysed in the section. In this case it uses the four arguments passed to the executable at run time to do the calculation. This means that those arguments are necessary to analyse the file, preventing someone without any context from analysing the file properly. The calculated hashes are the same as in the shellcode.

Once loaded in memory and decrypted, the embedded code, which we will call Stage 2, is loaded and run.

The code resolves some Windows APIs using the same API hashing algorithm used in the shellcode (Figure 8). It tries 20 times to retrieve the stage by connecting to a hardcoded C&C. If it fails, it tries again 20 times to connect to another C&C. If successful, this stage searches for “MZ” and “PE” headers in the retrieved file, loads it in memory, and jumps to its entry point.

Unfortunately, we did not manage to retrieve the stage, as the C&C returned 404 HTTP code.

For the October and November 2025 campaigns described above we could not determine the final payload in the infection chain, because Trend Vision One stopped the infection chain in an early stage. Consequently, it remains unclear whether the actors intended to deploy the ROMCOM backdoor or any related malware associated with Void Rabisu.

This is one of the reasons why these campaigns are categorised under a separate temporary intrusion set, SHADOW-VOID-042. Earlier this year, Proofpoint reported campaigns in 2025 that look like Void Rabisu at first sight, but that are tracked under a different intrusion set for now .

In Table 2 above, we compare the Void Rabisu intrusion set with the SHADOW-VOID-042 intrusion set. While there are similarities, this comparison does not lead us to a moderate or high confidence level that would justify merging the SHADOW-VOID-042 intrusion set into Void Rabisu. However, this may change as more data is collected, and additional campaigns are observed.

The actor group associated with the Void Rabisu intrusion set is one of the best-documented cases where a cybercrime group has shifted to more targeted attacks typically associated with advanced persistent threat (APT) groups. Originally, Void Rabisu was linked to Cuba ransomware and appeared to be financially motivated.

However, since the onset of the Russian war against Ukraine in 2022, Void Rabisu has moved away from primarily deploying ransomware (Figure 9). Instead, it has begun targeting Ukraine and its allies for espionage . In addition, Void Rabisu has strategically targeted politicians, participants of security conferences, pharmaceutical companies, and the energy sector .

Void Rabisu is associated with a particular backdoor called ROMCOM. This backdoor has gone through multiple enhancements, making it an advanced piece of malware. In July 2025, the Void Rabisu actor group used a zero-day in WinRar . Earlier in 2024, Void Rabisu was reported to use zero-days in the Mozilla browser and Microsoft Windows . In 2023, the actor group was reported to have used a zero-day in Microsoft Word against governments in Europe and North America.

This shows that Void Rabisu is an evolving intrusion set, that has undergone several changes. It remains to be seen whether we can merge the recent campaigns associated with SHADOW-VOID-042 into the Void Rabisu intrusion set.

The October and November 2025 of SHADOW-VOID-042 were ineffective for customers using Trend Vision One. In the section, we include hunting rules that users of the Trend Vision One platform can use to double-check whether their organisations were targeted.

Trend Vision One is the only AI-powered enterprise cybersecurity platform that centralises cyber risk exposure management and security operations, delivering robust layered protection across on-premises, hybrid, and multi-cloud environments.

To stay ahead of evolving threats, Trend customers can access Trend Vision One Threat Insights which provides the latest insights from Trend™ Research on emerging threats and threat actors.

Trend Vision One Threat Insights

Trend Vision One Intelligence Report (IOC Sweeping)

Trend Vision One App

Trend Vision One customers can use the App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.

SHADOW-VOID-042 Creation of Encrypted Binary

eventSubId: (101 OR 109) AND objectFilePath: *\\ProgramData\\Microsoft\\Windows\\SystemProcessHost.exe*

The indicators of compromise for this entry can be found here .