Cybersecurity analysts have noted the strategic resemblances between the malicious entities linked to the RomCom RAT and a faction that has been identified as distributing a loader referred to as TransferLoader.

Corporate security company Proofpoint is monitoring the operations tied to TransferLoader, attributing them to a group named UNK_GreenSec, while assigning the RomCom RAT perpetrators the label TA829. The latter is also recognized by the