Russia-linked hackers exploited Firefox and Windows zero-day bugs in ‘widespread’ hacking campaign

Security researchers have uncovered two previously unknown zero-day vulnerabilities that are being actively exploited by RomCom, a Russian-linked hacking group, to target Firefox browser users and Windows device owners across Europe and North America.

RomCom is a cybercrime group that is known to carry out cyberattacks and other digital intrusions for the Russian government. The group — which was last month linked to a ransomware attack targeting Japanese tech giant Casio — is also known for its aggressive stance against organizations allied with Ukraine, which Russia invaded in 2014.

Researchers with security firm ESET say they found evidence that RomCom combined use of the two zero-day bugs — described as such because the software makers had no time to roll out fixes before they were used to hack people — to create a “zero click” exploit, which allows the hackers to remotely plant malware on a target’s computer without any user interaction.

“This level of sophistication demonstrates the threat actor’s capability and intent to develop stealthy attack methods,” ESET researchers Damien Schaeffer and Romain Dumont said in a blog post on Monday.

RomCom’s targets would have to visit a malicious website controlled by the hacking group in order to trigger the zero-click exploit. Once exploited, RomCom’s eponymous backdoor would be installed on the victim’s computer, allowing broad access to a victim’s device.

Schaeffer told TechCrunch that the number of potential victims from RomCom’s hacking campaign ranged from a single victim per country to as many as 250 victims, with the majority of targets based in Europe and North America.

Mozilla patched the vulnerability in Firefox on October 9, a day after ESET alerted the browser maker. The Tor Project, which develops the Tor Browser based on Firefox’s codebase, also patched the vulnerability; though Schaeffer told TechCrunch that ESET has seen no evidence that the Tor Browser was exploited during this hacking campaign.

Microsoft patched the vulnerability affecting Windows on November 12. Security researchers with Google’s Threat Analysis Group, which investigates government-backed cyberattacks and threats, reported the bug to Microsoft, suggesting that the exploit may have been used in other government-backed hacking campaigns.