Evilnum threat actors have resurfaced in a new attack campaign against immigration entities throughout the United Kingdom and Europe. Previously, Evilnum has been known for targeting organizations within the financial services industry with extensive social engineering campaigns and custom malware payloads. In their recent campaign, Evilnum actors distributed phishing emails containing malicious Microsoft Word documents to targeted corporations. The Word documents urge the user to “Enable Editing” on the document by stating that enabling the feature allows for “Compliance,” “Complaint,” and “Proof of Ownership.” Once the user enables editing, malicious JavaScript code is executed and downloads a custom loader to the system. After being successfully loaded and establishing persistence on the system, several scheduled tasks are set to run and communicate back to actor-controlled command-and-control (C2) servers. The customized malware utilizes the Heaven’s Gate technique, allowing for 32-bit malware to hide API calls on 64-bit environment and remain undetected by anti-virus software. This technique has been patched in recent versions of Windows 10, which entices Evilnum actors to target out-of-date Windows instances to successfully deploy their attacks. CTIX continues to urge users to validate the integrity of all emails prior to downloading any attachments or visiting any embedded links.