Hackers Use Evilnum Malware to Target Cryptocurrency and Commodities Platforms

The advanced persistent threat (APT) actor tracked as Evilnum is
once again exhibiting signs of renewed activity aimed at European
financial and investment entities.

“Evilnum is a backdoor that can be used for data theft or to
load additional payloads,” enterprise security firm Proofpoint
said^[1]
in a report shared with The Hacker News. “The malware includes
multiple interesting components to evade detection and modify
infection paths based on identified antivirus software.”

Targets include organizations with operations supporting foreign
exchanges, cryptocurrency, and decentralized finance (DeFi). The
latest spate of attacks are said to have commenced in late
2021.

The findings also dovetail with a report from Zscaler last month
that detailed^[2]
low-volume targeted attack campaigns launched against companies in
Europe and the U.K.

Active since 2018, Evilnum^[3]
is tracked by the wider cybersecurity community using the names
TA4563 and DeathStalker, with infection chains culminating in the
deployment of the eponymous backdoor that’s capable of
reconnaissance, data theft, or fetching additional payloads.

The latest set of activities flagged by Proofpoint incorporate
updated tactics, techniques, and procedures (TTPs), relying on a
mix of Microsoft Word, ISO, and Windows Shortcut (LNK) files sent
as email attachments in spear-phishing emails to the victims.

Other variants of the campaign spotted in early 2022 have made
use of financial lures to entice recipients into opening .LNK files
within malicious ZIP archive attachments or clicking on OneDrive
URLs containing either an ISO or LNK file.

In yet another instance, the actor switched up the modus
operandi to deliver macro-laden Microsoft Word documents that drop
obfuscated JavaScript code designed to launch the backdoor
binary.

This methodology was once again changed in mid-2022 to
distribute Word documents, which attempt to retrieve a remote
template and connect to an attacker-controlled domain. Regardless
of the distribution vector employed, the attacks lead to the
execution of the Evilnum backdoor.

Although no next-stage malware executables were identified, the
backdoor is known to act as a conduit to deliver payloads from the
malware-as-a-service (MaaS) provider Golden Chickens.

“Financial organizations, especially those operating in Europe
and with cryptocurrency interests, should be aware of TA4563
activity,” Sherrod DeGrippo, vice President of threat research and
detection at Proofpoint, said in a statement. “The group’s malware
known as Evilnum is under active development.”