The advanced persistent threat (APT) actor tracked as Evilnum is once again exhibiting signs of renewed activity aimed at European financial and investment entities.
“Evilnum is a backdoor that can be used for data theft or to load additional payloads,” enterprise security firm Proofpoint said in a report shared with The Hacker News. “The malware includes multiple interesting components to evade detection and modify infection paths based on identified antivirus software.”
Targets include organizations with operations supporting foreign exchanges, cryptocurrency, and decentralized finance (DeFi). The latest spate of attacks are said to have commenced in late 2021.
