Cybersecuritydive

Russian Hackers Target US Engineering Firm Linked to Ukraine

First seen 25 Nov 2025, 17:27 UTC • •24.3

Article Content

1 / 6

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A U.S.-based civil engineering firm was attacked by the Russia-aligned threat group RomCom, which utilized SocGholish malware in a September attack. The attack is believed to be connected to the firm's work for a U.S. municipality that has a sister city in Ukraine.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 225d ago How this analysis works

Threat Graph

10 entities, 23 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

GRU Unit 29155
RomCom
TA569

Technique (3)

Malware
Phishing
T1566.002 - Spearphishing Link

Organization (2)

International Red Cross
Unicef

Malware (1)

SocGholish

Tool (1)

WinRar

Relationships

GRU Unit 29155 uses SocGholish
RomCom uses SocGholish
TA569 uses SocGholish
GRU Unit 29155 uses WinRar
RomCom uses WinRar
TA569 uses WinRar
GRU Unit 29155 uses Malware
GRU Unit 29155 uses Phishing
GRU Unit 29155 uses T1566.002 - Spearphishing Link
RomCom uses Malware
RomCom uses Phishing
RomCom uses T1566.002 - Spearphishing Link
TA569 uses Malware
TA569 uses Phishing
TA569 uses T1566.002 - Spearphishing Link
GRU Unit 29155 targets International Red Cross
GRU Unit 29155 targets Unicef
RomCom targets International Red Cross
RomCom targets Unicef
TA569 targets International Red Cross
TA569 targets Unicef
SocGholish targets International Red Cross
SocGholish targets Unicef

Following this threat?

Track GRU Unit 29155, SocGholish and International Red Cross in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed