SingleCamper

SingleCamper is a DLL-based RAT variant of RomCom, used by the UAT‑5647 threat group (also known as Russian‑speaking RomCom). It’s loaded from registry into memory via ShadyHammock, communicates over localhost, and prevents concurrent instances via a global mutex. It performs system recon, tunneling, and exfiltration.