The Russia-aligned RomCom gang exploited the vulnerabilities to target hundreds of Firefox users across Europe and North America.

Further investigation led to the discovery of a second vulnerability, this time in Windows, tracked as CVE-2024-49039, WHICH allows previously authenticated crooks to run arbitrary code in the system. By chaining the two vulnerabilities together, the attackers were able to deploy backdoors on target devices.

Russian-based RomCom cybercrime group chained two zero-day vulnerabilities in recent attacks targeting Firefox and Tor Browser users across Europe and North America.

The no-click exploit launched in October infected computers in Europe and North America with the RomCom backdoor when victims were redirected through attacker-controlled websites.

ESET Research details the analysis of a previously unknown vulnerability in Mozilla products exploited in the wild and another previously unknown Microsoft Windows vulnerability, combined in a zero-click exploit.