Loading threat actor…
Void Rabisu is a Russian-origin threat actor associated with the RomCom remote access trojan. The group has been observed using HTTPS for command-and-control communications and employing binary padding to obfuscate payloads, indicating an emphasis on stealth and defense evasion. Public reporting links Void Rabisu to malware-enabled intrusion activity centered on remote access and post-compromise control rather than ransomware operations. Known naming in the available reporting identifies the actor as Void Rabisu and associates it with RomCom-based campaigns.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 malware family attributed to this actor across reporting.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.