What tactics and techniques does RomCom use?

How RomCom’s intrusion chain typically starts

RomCom’s tradecraft is usually built around initial access through social engineering and weaponised content. The common pattern is not a single exploit, but a sequence that turns user interaction into execution, then execution into a foothold. That means the early stages are often visible in email, web, or document handling before the intrusion becomes more obviously malicious.

In practice, defenders should treat malicious links, attached documents, and download prompts as part of one access chain rather than isolated events. The important question is whether a user was induced to open, enable, or launch content that then executed something unexpected. That is where phishing and malware delivery start to overlap.

What RomCom does after it gets in

Once access is obtained, the activity described for RomCom includes persistence and stealthy post-compromise operations. That usually means the actor is trying to remain in the environment long enough to collect credentials, maintain access, and blend into routine activity. The direct answer’s emphasis on credential theft and abnormal authentication activity is a strong hint that identity abuse is part of the post-compromise phase.

Suspicious execution from common file types is especially important because it often signals abuse of normal-looking content to trigger code execution. A document, shortcut, archive, or link may appear ordinary while actually serving as the launch point for a broader intrusion chain. That is why file origin, file type, and process ancestry matter as much as the payload itself.

How to map RomCom activity to ATT&CK-style thinking

For defenders, the value in naming tactics and techniques is not taxonomy for its own sake, but the ability to recognise recurring attack behaviour across campaigns. RomCom activity aligns with techniques commonly seen in intrusion sets that use phishing, credential access, persistence, and evasive post-compromise actions. That makes attacker tradecraft easier to hunt when you group events by behaviour rather than by filename or domain alone.

Use MITRE ATT&CK Enterprise Matrix to translate observed behaviour into huntable patterns such as credential access, persistence, and execution after user interaction. If you are building a detection playbook, the right starting point is the sequence of actions, not the malware name.

The phishing side of the chain is also worth breaking out separately. Top 10 Phishing Techniques is useful when you need to distinguish link-based lures, document-based lures, and other user-interaction paths that can lead to the same downstream compromise.

Risk and Threat Considerations

RomCom’s techniques matter because they combine user deception with credential-focused follow-through. That creates a path from a single click or open action to mailbox abuse, identity compromise, and longer dwell time. The main risk is not just malware execution, but the downstream ability to operate using legitimate-looking access and routine authentication flows.

Failure mechanism: A user interaction chain, such as a link, document, or attachment, triggers execution or credential capture, then the actor leverages stolen access or persistence to continue operating without obvious alerts.

Impact: Organisations can lose email integrity, session trust, and visibility into who is actually acting inside the environment. That can expand from one compromised account into broader internal reconnaissance, lateral movement, or further phishing from trusted infrastructure.

Practitioner Guidance

What to verify: Correlate suspicious document or link opens with process creation, outbound connections, mailbox rule changes, authentication anomalies, and any credential-related alerts. The most useful evidence is a timeline that proves whether the user interaction led to code execution or account abuse.

What to prioritise: Focus first on the accounts, mailboxes, and endpoints that show both user-driven execution and abnormal authentication. If those two signals line up, treat the event as a likely intrusion path rather than a simple malware alert.

Practitioner takeaway: With RomCom, the key judgement is to hunt the chain, not the artifact, because the real danger is the combination of social engineering, credential abuse, and quiet persistence after the first click.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?