Void Rabisu, a malicious actor believed to be associated with the RomCom backdoor, was thought to be driven by financial gain because of its ransomware attacks. Trend Micro researchers have discovered that the use of RomCom in recent attacks suggests that they have changed to geopolitical motivations.