Trendmicro

SHADOW-VOID-042 Spear-Phishing Campaign Targets Multiple Industries

First seen 12 Dec 2025, 07:49 UTC • Feeds.Trendmicro

•32.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

In November 2025, a spear-phishing campaign utilizing Trend Micro-themed lures targeted various sectors, including energy, defense, pharmaceuticals, and cybersecurity. The campaign was detected and mitigated by the Trend Vision One™ platform, which identified similarities to previous attacks attributed to the Void Rabisu group.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

16 entities, 52 inferred relationships (STIX 2.1).

Threat Actor (5)

RomCom
Storm-0978
Tropical Scorpius
Void Rabisu
Cuba Ransomware

Technique (3)

Phishing
T1053 - Scheduled Task
T1566 - Spearphishing

Campaign (1)

Shadow-void-042

Organization (4)

Cloudflare
Tdmsec
Trend Micro
WeChat

Vulnerability (1)

CVE-2018-6065

Affected Platform (1)

Windows

Tool (1)

Chrome

Relationships

RomCom uses Chrome
Storm-0978 uses Chrome
Tropical Scorpius uses Chrome
Void Rabisu uses Chrome
Cuba Ransomware uses Chrome
RomCom uses Phishing
RomCom uses T1053 - Scheduled Task
RomCom uses T1566 - Spearphishing
Storm-0978 uses Phishing
Storm-0978 uses T1053 - Scheduled Task
Storm-0978 uses T1566 - Spearphishing
Tropical Scorpius uses Phishing
Tropical Scorpius uses T1053 - Scheduled Task
Tropical Scorpius uses T1566 - Spearphishing
Void Rabisu uses Phishing
Void Rabisu uses T1053 - Scheduled Task
Void Rabisu uses T1566 - Spearphishing
Cuba Ransomware uses Phishing
Cuba Ransomware uses T1053 - Scheduled Task
Cuba Ransomware uses T1566 - Spearphishing
RomCom exploits CVE-2018-6065
Storm-0978 exploits CVE-2018-6065
Tropical Scorpius exploits CVE-2018-6065
Void Rabisu exploits CVE-2018-6065
Cuba Ransomware exploits CVE-2018-6065
Chrome exploits CVE-2018-6065
Shadow-void-042 attributed to RomCom
Shadow-void-042 attributed to Storm-0978
Shadow-void-042 attributed to Tropical Scorpius
Shadow-void-042 attributed to Void Rabisu
Shadow-void-042 attributed to Cuba Ransomware
CVE-2018-6065 targets Windows
RomCom targets Cloudflare
RomCom targets Tdmsec
RomCom targets Trend Micro
RomCom targets WeChat
Storm-0978 targets Cloudflare
Storm-0978 targets Tdmsec
Storm-0978 targets Trend Micro
Storm-0978 targets WeChat
Tropical Scorpius targets Cloudflare
Tropical Scorpius targets Tdmsec
Tropical Scorpius targets Trend Micro
Tropical Scorpius targets WeChat
Void Rabisu targets Cloudflare
Void Rabisu targets Tdmsec
Void Rabisu targets Trend Micro
Void Rabisu targets WeChat
Cuba Ransomware targets Cloudflare
Cuba Ransomware targets Tdmsec
Cuba Ransomware targets Trend Micro
Cuba Ransomware targets WeChat

Continue Reading

Exploitation of WinRAR CVE-2025-8088 Threatens Ukrainian Organizations Exploitation of WinRAR Path Traversal Flaw Continues Amid CISA Warning Russian-linked Threat Actors Deploy SocGholish Malware via Fake Browser Updates Russian Cyber Groups Target US Engineering Firm with Advanced Attacks Russian Hackers Target US Engineering Firm Linked to Ukraine

SHADOW-VOID-042 Spear-Phishing Campaign Targets Multiple Industries

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading