EvilnumThreat actor
- deathstalker
- jointworm
- knockout spider
- ta4563
ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented previously, little has been published about the group behind it and how it operates.From MISP Galaxy
Last reported 3 months ago, by Recorded Future3 reports
ATT&CK techniques
6 of 61 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027.001 Obfuscated Files or Information: Binary Padding”
- T1027.007Dynamic API Resolution
“T1027.007 Obfuscated Files or Information: Dynamic API Resolution”
- T1055Process Injection
“T1055.012 Process Injection: Process Hollowing”
- T1548Abuse Elevation Control Mechanism
“T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control”
- T1548.002Bypass User Account Control
“T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control”
- T1559.001Component Object Model
“T1559.001 Inter-Process Communication: Component Object Model”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
TAG-195 Upgrades MaaS Ecosystem with Modular Tools“Public reporting by eSentire has previously linked TAG-195 tooling to FIN6, Cobalt Group, and Evilnum, three financially motivated criminal groups, suggesting the ecosystem serves a select customer base; however, details on sales models and access conditions remain unknown.”
-
Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders“NSFOCUS has attributed DarkMe to a financially motivated group called Evilnum, which is known for targeting financial organizations.”
-
Exploring the REF2731 Intrusion Set“This research was attributed to the financially motivated threat group, Evilnum [1, 2] and the DarkCasino campaign.”
Thanks — we review every report.