Cybersecuritydive

Russian Hackers Target US Engineering Firm Linked to Ukraine

First seen 25 Nov 2025, 17:27 UTC • Wfmj

•24.3

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A U.S.-based civil engineering firm was attacked by the Russia-aligned threat group RomCom, which utilized SocGholish malware in a September attack. The attack is believed to be connected to the firm's work for a U.S. municipality that has a sister city in Ukraine.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

13 entities, 38 inferred relationships (STIX 2.1).

Threat Actor (4)

Fancy Bear
GRU Unit 29155
RomCom
Ta569

Technique (5)

Malware
Phishing
Zero-day Exploit
Initial Access
T1566.002 - Spearphishing Link

Organization (2)

International Red Cross
Unicef

Malware (1)

SocGholish

Tool (1)

WinRar

Relationships

Fancy Bear uses SocGholish
GRU Unit 29155 uses SocGholish
RomCom uses SocGholish
Ta569 uses SocGholish
Fancy Bear uses WinRar
GRU Unit 29155 uses WinRar
RomCom uses WinRar
Ta569 uses WinRar
Fancy Bear uses Malware
Fancy Bear uses Phishing
Fancy Bear uses Zero-day Exploit
Fancy Bear uses Initial Access
Fancy Bear uses T1566.002 - Spearphishing Link
GRU Unit 29155 uses Malware
GRU Unit 29155 uses Phishing
GRU Unit 29155 uses Zero-day Exploit
GRU Unit 29155 uses Initial Access
GRU Unit 29155 uses T1566.002 - Spearphishing Link
RomCom uses Malware
RomCom uses Phishing
RomCom uses Zero-day Exploit
RomCom uses Initial Access
RomCom uses T1566.002 - Spearphishing Link
Ta569 uses Malware
Ta569 uses Phishing
Ta569 uses Zero-day Exploit
Ta569 uses Initial Access
Ta569 uses T1566.002 - Spearphishing Link
Fancy Bear targets International Red Cross
Fancy Bear targets Unicef
GRU Unit 29155 targets International Red Cross
GRU Unit 29155 targets Unicef
RomCom targets International Red Cross
RomCom targets Unicef
Ta569 targets International Red Cross
Ta569 targets Unicef
SocGholish targets International Red Cross
SocGholish targets Unicef

Continue Reading

APT28 Exploits Zimbra Vulnerability in Ongoing Attacks Against Ukraine GRU Compromises Home Routers in 23 States to Steal Outlook Credentials Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign Widespread DNS Poisoning Campaign Targets Hotel Wi-Fi to Steal Credentials Russian FSB Exploits Vulnerable Routers to Target Critical Infrastructure Russia's Hybrid Warfare Threatens UK with Cyberattacks and Sabotage

Russian Hackers Target US Engineering Firm Linked to Ukraine

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading