Threat Research

RomCom vs. TransferLoader highlights two related cybercriminal operations. TA829 conducts espionage and cybercrime using tools based on the legacy RomCom backdoor. A highly similar campaign, using a new loader and backdoor called TransferLoader, is linked to a separate cluster named UNK_GreenSec....

TransferLoader is a newly identified malware loader active since February 2025, comprising a downloader, loader, and backdoor module. It was observed deploying Morpheus ransomware at a U.S. law firm. The malware uses heavy obfuscation to hinder analysis and enables remote command execution. Its backdoor leverages IPFS as a fallback for C2 updates....