RomCom Exploits SocGholish Loader in U.S. Civil Engineering Breach
In June 2025, a U.S.-based civil engineering firm was targeted by the RomCom cybercriminal group leveraging the SocGholish JavaScript loader to deliver the advanced Mythic Agent malware. This marked the first known instance of RomCom using SocGholish for payload distribution. Attackers gained initial access through fake browser update lures hosted on compromised websites, allowing them to deploy the remote access trojan (RAT) and establish persistent control within the victim’s network. The attack resulted in exposure of sensitive engineering data and raised concerns regarding lateral movement and potential data exfiltration. This incident illustrates the ongoing trend of converging threat actor tactics, with attackers combining phishing, living-off-the-land tools, and stealthy malware loaders to increase their reach. As cybercriminal organizations diversify their infection vectors, organizations must swiftly adapt their detection and response strategies.
Kill Chain
