Void Rabisu
Aliases: Tropical Scorpius
- First seen
- 2022-06-15 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- team
- Actor type
- criminal, nation-state
- Profile updated
- 2026-07-07 12:03:16
Targeted industries: financial-services government-and-public-sector energy-and-utilities
Targeted regions: country_code:ua country_code:pl country_code:lt
Context
Void Rabisu is an intrusion set associated with both financially motivated ransomware attacks and targeted campaigns on Ukraine and countries supporting Ukraine.
Detection coverage
- 1 YARA rules
Malware & tools used
- Cuba (malware)
- ROMCOM RAT (malware)
Reports & references
- Trend Micro — Void Rabisu Targets Female Leaders With New Romcom Variant (report)
- Trend Micro — Void Rabisu S Use Of Romcom Backdoor Shows A Growing Shift In Th (report)