Evilnum Malware

By Ashwin Venugopal -

 





About Evilnum

The Evilnum malware mainly targets FinTech companies and it has been operating since 2018. However, very little have been published about the operating group behind this malware and its functioning. 

Its toolset and infrastructure have been considerably evolved with time, and now consists of a mixture of customized and homemade malware with combination of the tools purchased from Golden Chickens, which is a Malware-as-a-Service (MaaS) provider having many infamous customers like FIN6 and Cobalt Group. 

How does it works?

This APT group is using updated tactics, techniques, and procedures to target their victims. Previously, this threat group used Windows Shortcut files (LNK) sent inside malicious files (ZIP) as email attachments in spear phishing emails to the victims. Recently, they have started using MS Office Word documents, leveraging document template injection to deliver the malicious payload in a system. 

Several undetected domains associated with Evilnum have been discovered, indicating that this threat group has been successfully doing its activities under the radar and remained undetected for a very long time. 

Main Points

  • Evilnum has been mainly targeting FinTech (Financial Services) companies dealing with trading and compliance across UK and Europe. 

  • They are also targeting Intergovernmental organizations that deals with International Migration Services. 

  • The attack timeline and nature of choosing targets directly coincide with the Russia-Ukraine conflict.

  • Before, they used a heavily obfuscated JavaScript to decrypt and drop the payloads on the endpoints. This JavaScript configured a scheduled task to run the dropped binary. Now, this obfuscation technique has significant improvements as compared to the previous versions Evilnum.

  • Evilnum carefully chooses the names of all the file system artifacts created during the execution in order to spoof the legitimate Windows as well as the names of the other legitimate third parties.

  • The threat group registers multiple domain names, for every new campaign, via specific keywords related to the targeted industry. 

Prevention

Although Evilnum is very much capable of going undetected for years before causing destruction in an organization's system, there are certain ways to ensure safety against it, they are:

  • Make use of the many antivirus software available to protect and mitigate the attacks of threat actors like Evilnum.

  • Have a good cyber incident plan, that has been already tested via tabletop exercises.

  • Always review the security plan and regularly update it after it is tested on real cyber threats.

  • An organization must have a detailed defense strategy according to the risk analysis approach.

  • Educate the employees regarding cybersecurity and the potential dangers of opening malicious documents. Use annual or quarterly training modules to prevent threat actors from tricking employees into opening malicious email attachments. 


















































Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more