Proofpoint released “10 Things I Hate about Attribution: RomCom vs. TransferLoader” detailing connections between RomCom and TransferLoader. While the researchers said the backdoors were typically used by different groups — RomCom by TA829 and TransferLoader by UNK_GreenSec, they did see similarities between the threat actors’ campaigns.