Over the past few months, TA4563 has been targeting European financial organizations in several campaigns with the end goal of delivering the “EvilNum” malware variant. Since December 2021, TA4563 has conducted three separate campaigns against cryptocurrency, foreign exchanges, and decentralized finance (DeFi) institutions throughout the financial sector. The first campaign attempted to deliver malicious documents posing as registration forms for a financial trading platform. The malicious documents, once downloaded, communicate with actor-operated command-and-control (C2) nodes to download additional files to deliver the final EvilNum payload on the compromised system. Similarly in the succeeding campaign, TA4563 actors attempted to deliver the EvilNum payload via OneDrive to download either a Windows shortcut file (.lnk) or a CD/DVD image (.iso). Lastly, in the most recent campaign TA4563 changed their method of attack once more and attached macro-infected Microsoft Word document templates to their social engineering emails. Once macros were enabled on the victim system, the infected document would communicate with TA4563 C2 nodes to download additional files to install the EvilNum payload. In terms of malware, EvilNum has the capabilities to detect and avoid anti-virus programs, perform device reconnaissance, send device data back to C2 servers, and download additional malware tools from the Golden Chickens malware-as-a-service. While the campaigns are targeted towards European financial institutions, all institutions throughout the industry should be on high alert for similar malicious activity. CTIX continues to urge users to validate the integrity of email communications prior to downloading any attachments or visiting any embedded links to lessen the risk of threat actor compromise.