The New Formbook Malware Threatening Eurasia: Lessons from ComicForm

The Rise of ComicForm: Unmasking New Cyber Threats

In 2025, a previously unknown hacking group known as ComicForm has emerged as a significant threat, primarily targeting industrial, financial, biotechnology, and research sectors in Belarus, Kazakhstan, and Russia. This group's phishing campaign entails sending seemingly innocuous emails that prompt recipients to open malicious attachments disguised as documents. One such example of their deceitful tactics includes subject lines like "Waiting for the signed document" or "Invoice for Payment," which collectively illustrate a sophisticated method of deception.

A Closer Look at the Malware: Formbook

Once the unsuspecting victims open an infected .exe file, they unwittingly execute a chain reaction leading to the deployment of Formbook malware. This malware is uniquely designed to not only hijack user credentials but also mask its activities by creating scheduled tasks and manipulating Windows Defender settings.
Interestingly, the malware has a quirky element—a code snippet that includes harmless Tumblr links featuring superheroes like Batman. However, these links serve no practical function other than to give the hack group its name. F6 Cybersecurity, which revealed these details, has emphasized the threat these attackers pose, particularly as their methodology evolves.

Phishing Tactics Targeting Various Sectors

Another concerning aspect of ComicForm's operations is their ability to craft emails in both English and Russian, suggesting they are broadening their scope to potentially include organizations outside their initial targeted regions. Recent instances include phishing attempts directed at Russian manufacturers and attempts to extract sensitive data from Belarusian banks. The attacks rely heavily on social engineering tactics, manipulating users into believing they are accessing legitimate document management services.

Implications for Cybersecurity and Business

The consequences of such breaches extend beyond individual companies, posing a risk to regional and global cybersecurity infrastructures. As the tactics of groups like ComicForm evolve, it becomes increasingly important for organizations to educate their workforce about the signs of phishing attempts.

Conclusion: The Need for Vigilance

As cyber threats become more sophisticated, vigilance and education are crucial in safeguarding sensitive information. Organizations must proactively invest in cybersecurity measures and regularly train employees to recognize phishing threats to mitigate risks.
The potential implications of data theft remind us why cybersecurity should be a priority in every sector—especially as cybercriminals continue to innovate.