Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Friday, 3 February, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Evilnum Hackers Return With New Activity Targeting International Migration Campaigns

Researchers have seen a spike in activity within the Evilnum group in 2022.

by Guru Writer
June 29, 2022
in Cyber Bites
Two computer screens filled with code. Shadowed figure.
Share on FacebookShare on Twitter

The Evilnum hacking group have been targeting European organisations that are involved in international migration, showing renewed signs of malicious activity within the group.

Evilnum is an advanced persistent threat (APT) that has been active since at least 2019 and had its campaign and tools exposed in 2020.

In 2020, ESET published a technical report describing the threat group’s tactics against compaines in the financial technology sector, using “homemade”, custom malware.

Zscaler’s analysts have discovered the latest exposure, having been tracking Evilnum’s activity since the beginning of 2022. They have captured various artefacts from the attacks.

The targeting and timing coincided with the Russian invasion of Ukraine, with key migration organisations receiving malicious emails containing macro-laden documents

The documents used by Evilnum in the campaign carry varying filenames, usually containing the term “compliance.” Zscaler identified at least nine different documents used, as mentioned in the IoC section of the report.

The attachment leverage the template injection and VBA code stomping technique to evade detection. This leads to the execution of heavily obfuscated JavaScript.

This decrypts and drops a malware loader (“SerenadeDACplApp.exe”) and an encrypted binary (“devZUQVD.tmp”), and also creates a scheduled task (“UpdateModel Task”) for persistence.

The loader performs preliminary checks and loads the binary under an extracted file name. The “Heaven’s gate” technique is used during the binary injection to evade AV detection.

This technique involves invoking 64-bit code in 32-bit processes. It has been mitigated in Windows 10, but Evilnum still likely uses it to target running older OS versions.

The backdoor that is loaded onto the compromised systems executes to decrypt the backdoor configuration, resolve API addresses from the libraries retrieved from configuration, and perform a mutex check, amongst other things.

Once it has embedded the encoded string inside the cookie header field by selecting one of the cookie type strings from the configuration, the backdoor picks a C2 domain and a path string from the configuration and sends a beacon network request. The C2 may answer with a new encrypted payload.

Also, the backdoor captures machine snapshots and sends them to he C2 via POST requests, exfiltrating stolen data in an encrypted form.

The report suggests that Evilnum is still an active threat.

The actor’s origin remains unknown, but in its most recent victimology indicates a state-level interest in espionage campaigns, liked by researchers to the Belarusian threat group “Ghostwriter.”

 

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

Appointment of four new executives ignites Illusive’s international expansion

Next Post

The Top Mobile Security Threats of 2022

Recent News

london-skyline-canary-wharf

Ransomware attack halts London trading

February 3, 2023
Ransomware conversations: Why the CFO is pivotal to discussing and preparing for risk

Ransomware conversations: Why the CFO is pivotal to discussing and preparing for risk

February 2, 2023
JD Sports admits data breach

JD Sports admits data breach

January 31, 2023
Acronis seals cyber protection partnership with Fulham FC

Acronis seals cyber protection partnership with Fulham FC

January 30, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information