Evilnum

Evilnum is a financially motivated cybercrime threat actor active since at least 2018 and widely associated with targeted intrusions against financial technology firms, online trading and brokerage-related organizations, and other entities handling sensitive financial or compliance data. The group is commonly believed to operate out of Belarus. Reporting has also linked Evilnum to broader targeting of financial firms, cryptocurrency-related entities, law firms, governments, and at least one intergovernmental organization involved in migration services. The actor is also tracked in some reporting as DeathStalker, though that overlap is not uniformly treated across vendors. Evilnum is known for highly selective spearphishing operations, often using lures themed around Know Your Customer documentation, identity records, financial paperwork, resumes, or job-application content. Historic delivery chains frequently used ZIP archives containing malicious LNK files masquerading as benign documents or images. More recent campaigns have also used malicious Word documents with template injection, VBA stomping, and heavily obfuscated JavaScript. The group has repeatedly relied on staged, modular infection chains in which JavaScript acts as a dropper or loader for subsequent payloads. The actor has used both proprietary malware and tooling from the Golden Chickens malware-as-a-service ecosystem. Associated tooling includes More_eggs and Golden Chickens components such as TerraPreter, TerraStealer, and TerraTV. Evilnum has also deployed custom malware families including the Python-based PyVil RAT and VileRAT, with VileLoader observed as a loader for the latter. PyVil RAT supports command execution, keylogging, screenshot capture, SSH shell access, host profiling, credential and cookie theft, and modular extension through downloaded Python components, including a custom LaZagne variant. VileRAT has been described as a Python-based, modular remote-access malware family used for keystroke capture, command execution, and information theft. Operationally, Evilnum emphasizes stealth and layered execution. Observed tradecraft includes use of obfuscated JavaScript, scheduled-task persistence, in-memory payload decryption and mapping, downloader stages built from modified legitimate executables, and anti-analysis measures. The group has used PowerShell to bypass UAC, deleted infection artifacts for cleanup, and employed DLL sideloading, including use of TerraTV to load a malicious DLL via a legitimate remote-support application directory. Additional observed behaviors include downloading follow-on payloads, exfiltrating host and credential data, and deploying supplementary tools as needed during post-compromise activity. Evilnum’s campaigns are generally characterized by low volume, careful victim selection, and strong alignment with financial theft and intelligence collection against organizations that can provide access to funds, trading environments, credentials, or sensitive business information.