Evilnum
MITRE ATT&CK: G0120 View on attack.mitre.org
Aliases: DeathStalker, TA4563, EvilNum, Jointworm, KNOCKOUT SPIDER, Evilnum
- First seen
- 2018-01-01 00:00:00
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- team
- Actor type
- criminal
- Related IoCs
- 2 (1 malicious)
- Last IoC activity
- 2026-09-01 10:30:30
- Profile updated
- 2026-07-07 11:59:21
Targeted industries: financial-services technology-and-telecommunications
Targeted regions: country_code:gb country_code:fr country_code:es
Context
Evilnum is a financially motivated threat group that has been active since at least 2018.
Recent IoC activity
1 malicious indicator in Maltiverse are attributed to Evilnum (G0120). The 1 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| URL | https://github.com/QurtiDev/MalwareSourceCode | 2026-09-02 | 1 |
Detection coverage
- 3 YARA rules
- 304 Sigma rules
Malware & tools used
- System Checks (attack-pattern)
- Remote Desktop Software (attack-pattern)
- Steal Web Session Cookie (attack-pattern)
- Spearphishing Link (attack-pattern)
- Bypass User Account Control (attack-pattern)
- File Deletion (attack-pattern)
- DLL (attack-pattern)
- Malicious Link (attack-pattern)
- Credentials from Password Stores (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- JavaScript (attack-pattern)
- EVILNUM (malware)
- LaZagne (malware)
- More_eggs (malware)
Reports & references
- ESET — More Evil Deep Look Evilnum Toolset (report)
- Kaspersky — 98177 (report)
- Kaspersky — 99616 (report)
- proofpoint.com — Buy Sell Steal Evilnum Targets Cryptocurrency Forex Commodities (report)
- rewterz.com — Rewterz Threat Alert Evilnum Apt Group Active Iocs 7 (report)
- rewterz.com — Rewterz Threat Alert Evilnum Apt Group Targeting Financial Sector (report)
- CrowdStrike — Report2021Gtr (report)
- hivepro.com — Vulnerabilities Threats That Matter 25Th To 31St July (report)
- medium.com — Profiling Disrupting An Apt Spear Phishing Campaign Targeting Slack Users In The Financial Sector 9389533D5Fc2 (report)
- MITRE ATT&CK — G0120 (report)