Evilnum hackers use the same malware supplier as FIN6, Cobalt

guest · Jul 9, 2020

Evilnum hackers use the same malware supplier as FIN6, Cobalt
July 9, 2020
https://www.bleepingcomputer.com/ne...use-the-same-malware-supplier-as-fin6-cobalt/

Hackers in the Evilnum group have developed a toolset that combines custom malware, legitimate utilities, and tools bought from a malware-as-a-service (MaaS) provider that caters for big fintech threat actors.
The group has been active since at least 2018 and focuses on companies from the financial technology sector that offer trading and investment platforms.
Taking a shortcut
Its targets are both companies and their customers, the objective being to steal financial information.

According to ESET, Evilnum makes extensive use of tools from Golden Chickens, with the TerraLoader dropper. Among the payloads delivered this way is more_eggs, TerraStealer, TerraTV, and TerraPreter (decrypts a Meterpreter instance and runs it in memory).
Click to expand...

ESET assesses that the small number of specific targets combined with the use of legitimate tools have kept Evilnum activities largely undetected. Frequently updating the malicious components also contributes to the stealth of the operations.
Click to expand...

ESET: More evil: A deep look at Evilnum and its toolset

ESET research gives a detailed picture of the operations of the Evilnum group and its toolkit deployed in attacks against carefully chosen targets in the fintech sector
Click to expand...

guest · Sep 3, 2020

New Python-scripted trojan malware targets fintech companies
PyVil RAT is capable of keylogging, taking screenshots and more
September 3, 2020
https://www.zdnet.com/article/new-python-scripted-trojan-malware-targets-finance-sector/

A well-resourced hacking operation has deployed newly-developed trojan malware in a campaign targeting financial tech organisations with the aim of stealing email addresses, passwords and other sensitive corporate information – and the malicious code is bundled inside code ripped from legitimate applications.

Known as Evilnum, the advanced persistent threat (APT) group first emerged in 2018 and one of the reasons for their success is how often they've changed tools and tactics as they take aim at targets related to Fintech mostly located in Europe and the UK, although some victims are located in the Americas and Australia.
Click to expand...

Uncovered by cybersecurity researchers at Cybereason who've dubbed it PyVil RAT, the trojan allows attackers to secretly steal corporate information through the use of keylogging and taking screenshots, as well as the ability to collect information about the infected system, including which version of Windows is running, what anti-virus products are installed and whether USB devices are connected.

Evilnum is thought to remain active and it's likely only a matter of time before the group changes it's tools and techniques for targeting organisations in the Fintech space once more.
Click to expand...

Cybereason: No Rest for the Wicked: Evilnum Unleashes PyVil RAT

Over the course of the last few months, the Cybereason Nocturnus team has been investigating the activity of the Evilnum group. The group first emerged in 2018, and since then, Evilnum’s activity has been varied, with recent reports using different components written in Javascript and C# as well as tools bought from the Malware-as-a-Service provider Golden Chickens.
Click to expand...

KEY FINDINGS

Evilnum: The Cybereason Nocturnus team is tracking the operations of the Evilnum group, which has been active for the past two years, using a variety of tools.

Targeting the Financial Sector: The group is known to target FinTech companies, and is abusing the usage of the Know Your Customer( KYC) procedure in order to start the infection.

New Tricks: In this research, we see a deviation from the infection chain, persistence, infrastructure, and tools observed previously, including:

Modified versions of legitimate executables employed in an attempt to remain undetected by security tools.

Infection chain shift from a JavaScript Trojan with backdoor capabilities to a multi-process delivery procedure of the payload.

A newly discovered Python-scripted RAT dubbed PyVil RAT that was compiled with py2exe, which has the capability to download new modules to expand functionality.

Click to expand...

guest · Jul 21, 2022

Hackers Use Evilnum Malware to Target Cryptocurrency and Commodities Platforms
July 21, 2022

The advanced persistent threat (APT) actor tracked as Evilnum is once again exhibiting signs of renewed activity aimed at European financial and investment entities.

"Evilnum is a backdoor that can be used for data theft or to load additional payloads," enterprise security firm Proofpoint said in a report shared with The Hacker News. "The malware includes multiple interesting components to evade detection and modify infection paths based on identified antivirus software."
Targets include organizations with operations supporting foreign exchanges, cryptocurrency, and decentralized finance (DeFi). The latest spate of attacks are said to have commenced in late 2021.
The findings also dovetail with a report from Zscaler last month that detailed low-volume targeted attack campaigns launched against companies in Europe and the U.K.
Click to expand...

Active since 2018, Evilnum is tracked by the wider cybersecurity community using the names TA4563 and DeathStalker, with infection chains culminating in the deployment of the eponymous backdoor that's capable of reconnaissance, data theft, or fetching additional payloads.

Although no next-stage malware executables were identified, the backdoor is known to act as a conduit to deliver payloads from the malware-as-a-service (MaaS) provider Golden Chickens.

"Financial organizations, especially those operating in Europe and with cryptocurrency interests, should be aware of TA4563 activity," Sherrod DeGrippo, vice President of threat research and detection at Proofpoint, said in a statement. "The group's malware known as Evilnum is under active development."
Click to expand...

Proofpoint: Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities

Key Findings

TA4563 is a threat actor leveraging EvilNum malware to target European financial and investment entities, especially those with operations supporting foreign exchanges, cryptocurrency, and decentralized finance (DeFi).

EvilNum is a backdoor that can be used for data theft or to load additional payloads.

The malware includes multiple interesting components to evade detection and modify infection paths based on identified antivirus software.

Click to expand...

Overview
Since late 2021 through the present, Proofpoint Threat Research observed the group Proofpoint calls TA4563 targeting various European financial and investment entities with the malware known as EvilNum. The actor exclusively targeted entities in the Decentralized Finance (DeFi) industry in recently observed campaigns. The activity Proofpoint associates with TA4563 has some overlap with activity publicly associated with a group referred to as DeathStalker and EvilNum. The activity described in this report has some overlap with EvilNum activity publicly reported by Zscaler in June 2022.

The identified campaigns delivered an updated version of the EvilNum backdoor using a varied mix of ISO, Microsoft Word and Shortcut (LNK) files in late 2021 and early 2022, presumably as a method of testing the efficacy of the delivery methods. This malware can be used for reconnaissance, data theft, and to deploy additional payloads.
Click to expand...

Log in or Sign up

Evilnum hackers use the same malware supplier as FIN6, Cobalt

guest Guest

guest Guest

guest Guest

Log in or Sign up

Evilnum hackers use the same malware supplier as FIN6, Cobalt

guest Guest

guest Guest

guest Guest

Useful Searches