ta4563

TA4563 is a threat actor tracked by Proofpoint that has targeted European financial and investment entities since late 2021, with more recent observed campaigns focused exclusively on decentralized finance (DeFi) organizations. Proofpoint observed the group using the EvilNum malware family, a modular backdoor used for reconnaissance, data theft, and loading additional payloads. Proofpoint assessed TA4563 activity overlaps with activity publicly associated with DeathStalker and EvilNum, and also noted similarities with EvilNum activity reported by Zscaler in June 2022. Observed delivery methods evolved across campaigns and included Microsoft Word documents using remote templates, ISO files, and Windows shortcut (LNK) loaders, often delivered through financial-themed email lures and OneDrive links. Infection chains described by Proofpoint included LNK execution, cmd.exe and PowerShell, dynamically loaded C# code, and in earlier activity JavaScript components. Proofpoint reported that EvilNum campaigns were highly fenced, allowing only one download per IP address for final payload retrieval. The malware also adapted execution paths based on detected antivirus products including Avast, AVG, and Windows Defender, and attempted to invoke likely legitimate host-resident executables such as TechToolkit.exe and nvapiu.exe to evade detection. Proofpoint stated the tooling is under active development. Known aliases and related public associations directly mentioned in the content are DeathStalker and EvilNum.