Evilnum

Executive Summary

Evilnum, also known as DeathStalker, TA4563, Jointworm, and Knockout Spider, is a financially motivated threat group active since at least 2018. They are known for their advanced persistent threat (APT) tactics and have targeted sectors including finance and retail for data theft and financial gain.

Goals & Targeting

Evilnum primarily targets sectors with high financial value, such as finance and retail, where sensitive data can be monetized. Their targeting often includes geographies with significant economic activity or industries with weak security postures.

Evilnum operates with a primary focus on financial motivations, leveraging sophisticated techniques to compromise organizations. The group is known to deploy multi-stage attacks involving initial access through phishing, followed by the deployment of custom malware such as EVILNUM and More_eggs. Their activities often involve credential harvesting, system persistence, and data exfiltration to achieve their financial objectives. Evilnum has demonstrated a high level of operational continuity since first being observed in 2018.

Key Capabilities

• Advanced persistent threat (APT) tactics
• Custom malware development (EVILNUM, More_eggs)
• Spearphishing campaigns
• DLL injection techniques
• Credential harvesting from password stores

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Evilnum has been linked to numerous campaigns targeting financial and retail sectors. Their operations typically involve initial access through phishing, followed by lateral movement and data exfiltration. Campaign patterns include the use of legitimate tools for malicious purposes and long-term persistence within networks.

IOC Patterns

• Spearphishing links
• JavaScript injection attacks
• Malicious macro-laced Office documents
• DLL injection activities
• C2 communication over established protocols

Recommended Actions

• Implement robust email filtering and phishing detection solutions.
• Monitor for unusual network activity, particularly C2 behavior.
• Patch systems to prevent known vulnerabilities exploited by Evilnum.
• Educate employees on recognizing spearphishing attempts.

Suggested Tags