EVILNUM

Evilnum is a form of malware, first observed and reported in 2018, that is designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge, and can steal personal information, disrupt operations, or even hold data hostage for ransom. Initially, the Advanced Persistent Threat (APT) group DarkCasino used attack strategies similar to Evilnum, employing malicious shortcuts and image steganography to carry out phishing attacks. If a host system is running BitDefender, Evilnum will reach out to a different URL. A second version of Evilnum was discovered in 2019 during an unrelated incident response investigation, having successfully infiltrated a FinTech company. By 2021, Evilnum had evolved into a new variant that was particularly effective at evading both standard network- and host-based detection systems. This variant resurfaced within the financial sector, causing significant concern. During this period, the Water Hydra group emerged, initially mistaken for the Evilnum APT group due to similarities in their phishing techniques. However, by November 2023, after several successive campaigns, including one exploiting the well-known WinRAR code execution vulnerability CVE-2023-38831 to target stock traders, it became clear that Water Hydra was a distinct APT group from Evilnum. Despite this distinction, attributing specific attacks to either group proved challenging due to overlapping activity with other groups using more_eggs, namely FIN6, Cobalt Group, and Evilnum. The APT group DarkCasino, which initially borrowed attack strategies from Evilnum, gradually developed its own multi-level loading patterns based on several Visual Basic components after H2 2022, enabling larger-scale network attacks. Notably, the Russia-backed threat group Evilnum exploited a flaw discovered in the widely used software application WinRAR as a zero-day bug since April, using weaponized ZIP files to target cryptocurrency traders. As of the last report, there is potential for a new Evilnum campaign on the horizon.