Evilnum

MITRE ATT&CK: G0120 View on attack.mitre.org

Aliases: DeathStalker, TA4563, EvilNum, Jointworm, KNOCKOUT SPIDER, Evilnum

First seen
2018-01-01 00:00:00
Primary motivation
financial-gain
Sophistication
intermediate
Resource level
team
Actor type
criminal
Related IoCs
2 (1 malicious)
Last IoC activity
2026-09-01 10:30:30
Profile updated
2026-07-07 11:59:21

Targeted industries: financial-services technology-and-telecommunications

Targeted regions: country_code:gb country_code:fr country_code:es

Context

Evilnum is a financially motivated threat group that has been active since at least 2018.

Recent IoC activity

1 malicious indicator in Maltiverse are attributed to Evilnum (G0120). The 1 most recently updated:

TypeIndicatorUpdatedSources
URL https://github.com/QurtiDev/MalwareSourceCode 2026-09-02 1

Detection coverage

  • 3 YARA rules
  • 304 Sigma rules

Malware & tools used

  • System Checks (attack-pattern)
  • Remote Desktop Software (attack-pattern)
  • Steal Web Session Cookie (attack-pattern)
  • Spearphishing Link (attack-pattern)
  • Bypass User Account Control (attack-pattern)
  • File Deletion (attack-pattern)
  • DLL (attack-pattern)
  • Malicious Link (attack-pattern)
  • Credentials from Password Stores (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • JavaScript (attack-pattern)
  • EVILNUM (malware)
  • LaZagne (malware)
  • More_eggs (malware)

Reports & references

  • ESET — More Evil Deep Look Evilnum Toolset (report)
  • Kaspersky — 98177 (report)
  • Kaspersky — 99616 (report)
  • proofpoint.com — Buy Sell Steal Evilnum Targets Cryptocurrency Forex Commodities (report)
  • rewterz.com — Rewterz Threat Alert Evilnum Apt Group Active Iocs 7 (report)
  • rewterz.com — Rewterz Threat Alert Evilnum Apt Group Targeting Financial Sector (report)
  • CrowdStrike — Report2021Gtr (report)
  • hivepro.com — Vulnerabilities Threats That Matter 25Th To 31St July (report)
  • medium.com — Profiling Disrupting An Apt Spear Phishing Campaign Targeting Slack Users In The Financial Sector 9389533D5Fc2 (report)
  • MITRE ATT&CK — G0120 (report)

External references