Evilnum__2020__More_evil_A_deep_look_at_Evilnum_and_its_toolset_WeLiveSecurity.pdf

ESET's analysis profiles the Evilnum APT targeting fintech companies: attackers use spearphishing ZIPs containing double-extension LNKs that drop a malicious JavaScript first-stage which can deploy a C# backdoor (Evilnum) and additional tools. The group combines custom components and Malware‑as‑a‑Service (Golden Chickens) payloads (TerraLoader family, TerraPreter/Meterpreter, TerraStealer, TerraTV) to steal credentials, cookies, customer documents and enable stealthy remote access; the report includes IoCs and MITRE ATT&CK mappings.