Evilnum Threat Group Uses New Trojan to Target Financial Sector

Summary

Cybercriminal group Evilnum, known to target the financial sector, changed tactics in recent months. The group is employing PyVil, a new Python remote access trojan (RAT), which enables the threat actor to exfiltrate data, log keystrokes, take screenshots, and download additional tools and malware. PyVil is delivered to targets via phishing emails with Know Your Customer/Client (KYC) themes and include an LNK file attachment that contains a dropper, which delivers the RAT.

Recommendations

The NJCCIC recommends organizations employ a defense-in-depth cybersecurity program that includes user awareness training, an endpoint detection and response solution, email security gateway, and a comprehensive data backup plan. For more information on recent Evilnum activity and their use of the PyVil RAT, review the Cybereason blog post.