← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Evilnum APT returns with updated TTPs and New Targets
WHITE AlienVault 2022-06-29 Modified: 2022-06-29
55
IOCs
HIGH VOLUME
Researchers identified several instances of their low-volume targeted attack campaigns launched against the UK and Europe. In earlier campaigns observed in 2021, the main distribution vector used by this threat group was Windows Shortcut files (LNK) sent inside malicious archive files (ZIP) as email attachments in spear phishing emails to the victims. In the most recent instances, the threat actor has started using MS Office Word documents, leveraging document template injection to deliver the malicious payload to the victims’ machines.
evilnumaptmalicious documentsjavascriptvba macro
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (4 / 55 total)
All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 domain
TYPEINDICATORDESCRIPTIONCREATED
FileHash-SHA256 4ad43986f7130d8d1a40f0377e0c1ada1115fae3e972b339f728d0e794b4a20f SHA256 of 4406d7271b00328218723b0a89fb953b 2022-06-29
FileHash-SHA256 531e1e4e076fc0e5a792b60bd138209105f22b2e7b9818aff5efc0ff9f616917 SHA256 of 61776b209b01d62565e148585fda1954 2022-06-29
FileHash-SHA256 78c6c33ebb8d5311c85c58817a1cce7bd126aa9457155962e7d5d2ffcc74c805 SHA256 of 6d329140fb53a3078666e17c249ce112 2022-06-29
FileHash-SHA256 c4cedf78bf239c28e49e43a21c723ec66ffaca48a7b2c4767f73437325c7cc0d SHA256 of db0866289dfded1174941880af94296f 2022-06-29
References (1)
↗ https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets