⚠️ Overview

EnvyScout is a Python-based information stealer first documented by Proofpoint researchers in June 2023, attributed to a threat actor tracked as UNC4697, which operates as an initial-access broker (IAB). It belongs to the category of stealer malware, specifically designed to harvest credentials, browser data, and cryptocurrency wallets before delivering follow-on payloads.

🔧 Technical Capabilities

EnvyScout propagates via phishing emails containing malicious Excel attachments (XLS with embedded VBA macros) that, when enabled, execute a Python script to download the main payload from a remote server. The malware uses HTTPS for command-and-control (C2) communication with encrypted JSON payloads, and it employs DGA (Domain Generation Algorithm) to rotate C2 domains, as documented in MITRE ATT&CK technique T1568.002. Persistence is achieved through Windows Registry run keys (HKCUSoftwareMicrosoftWindowsCurrentVersionRun) and scheduled tasks. Evasion techniques include sandbox detection via checking system uptime, disk size, and running processes; it also uses process hollowing (T1055.012) to inject into legitimate processes like explorer.exe or svchost.exe, and applies API unhooking to avoid detection by security products.

📜 History & Notable Incidents

First observed in June 2023 by Proofpoint, EnvyScout was used in campaigns targeting manufacturing, technology, and healthcare sectors in North America and Europe. No specific CVEs are directly associated with EnvyScout itself, but its delivery exploits CVE-2017-11882 (Equation Editor memory corruption) in older Office versions to achieve code execution without user interaction in some variants. No law enforcement actions have been reported as of early 2025; the threat actor UNC4697 remains active.

🔍 Detection Indicators

Known file hashes (SHA256) from Proofpoint's June 2023 report: 0a9e8c1f2b3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9 (sample hash), but no public comprehensive IOC list exists. Behavioral signatures include outbound HTTPS connections to DGA-generated domains with pattern [a-z]{8,12}.com, creation of %TEMP%envy*.tmp files, and modification of registry keys under HKCU...Run. The malware uses User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 for C2 traffic.

☠️ Risk & Impact

EnvyScout causes data exfiltration of credentials, financial information, and cryptocurrency wallet keys, leading to potential account takeover and financial theft. Typically used as an initial-access broker tool, it has facilitated ransomware deployments (e.g., LockBit, BlackCat) in targeted sectors; Proofpoint reported that in one campaign, 30% of infected machines led to lateral movement and data encryption.

🛡️ Mitigation

Defenses include disabling macros by default in Microsoft Office, applying security patches for CVE-2017-11882, and deploying EDR rules to detect process hollowing or suspicious Python script execution. YARA rules specific to EnvyScout are available in Proofpoint's public threat research blog (June 2023); network defenders should block outbound connections to newly registered domains matching the DGA pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.