Evilnum hackers targeting financial firms with a new Python-based RAT

In an analysis published by Cybereason researchers yesterday,
the Evilnum group has not only tweaked its infection chain but has
also deployed a Python RAT called “PyVil RAT,” which possesses
abilities to gather information, take screenshots, capture
keystrokes data, open an SSH shell and deploy new tools.

“Since the first reports in 2018 through today, the group’s TTPs
have evolved with different tools while the group has continued to
focus on fintech targets,” the cybersecurity firm
said^[1].

“These variations include a change in the chain of infection and
persistence, new infrastructure that is expanding over time, and
the use of a new Python-scripted Remote Access Trojan (RAT)” to spy
on its infected targets.

While the modus operandi of gaining an initial foothold in the
compromised system remains the same, the infection procedure has
witnessed a major shift.

Besides using spear-phishing emails with fake know your customer
(KYC) documents to
trick employees of the finance industry into triggering the
malware, the attacks have moved away from using JavaScript-based
Trojans with backdoor capabilities to a bare-bones JavaScript
dropper that delivers malicious payloads hidden in modified
versions of legitimate executables in an attempt to escape
detection.

“This JavaScript is the first stage in this new infection chain,
culminating with the delivery of the payload, a Python written RAT
compiled with py2exe that Nocturnus researchers dubbed PyVil RAT,”
the researchers said.

“In previous campaigns of the group, Evilnum’s tools avoided
using domains in communications with the C2, only using IP
addresses,” the researchers noted. “While the C2 IP address changes
every few weeks, the list of domains associated with this IP
address keeps growing.”

As the APT’s techniques continue to evolve, it’s essential that
businesses remain vigilant and employees monitor their emails for
phishing attempts and exercise caution when it comes to opening
emails and attachments from unknown senders.

^[2][3][4][5]