Threat Actor Unknown origin

Evilnum

Also known as: DeathStalker · TA4563 · EvilNum · Jointworm · KNOCKOUT SPIDER

ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented previously, little has been published about the group behind it and how it operates. The group’s targets remain fintech companies, but its toolset and infrastructure have evolved and now consist of a mix of custom, homemade malware combined with tools purchased from Golden Chickens, a Malware-as-a-Service (MaaS) provider whose infamous customers include FIN6 and Cobalt Group.

MITRE ATT&CK TTPs 16

OS Credential Dumping

Credential Access

Data from Local System

Remote Services

Lateral Movement

Network Sniffing

Credential Access

Command and Scripting Interpreter

Defense Evasion

Command And Control

System Information Discovery

File and Directory Discovery

Credential Access

Exploitation for Client Execution

Source Articles

Golden Chickens Resurfaces With Four New Malware Families and Modular Implants

The Golden Chickens threat actor, tracked as TAG-195, has resurged with four new malware families: TinyEgg, ChonkyChicken, a modular variant of ChonkyChicken, and ChromEggscalator. These tools represent an evolution toward modular, operator-driven malware architectures designed for defense evasion and flexible post-compromise operations. The group uses ClickFix-style social engineering to deploy payloads, establishing persistent access and enabling browser theft, surveillance, and remote execution. The malware communicates via WebSockets to C2 servers and leverages shared infrastructure and techniques across families.

hacker-news ·4d ago