Evilnum (G0120) | Threat Actor Index

11

Techniques

3

Toolsets

0

CVEs Referenced

0

KEV Entries

About Evilnum

Evilnum is a financially motivated threat group that has been active since at least 2018.

View MITRE record ↗

Techniques by Tactic (11)

Initial Access

T1566.002 Spearphishing Link

Execution

T1059.007 JavaScriptT1204.001 Malicious LinkT1574.001 DLL

Privilege Escalation

T1548.002 Bypass User Account Control

Stealth

T1070.004 File DeletionT1497.001 System ChecksT1574.001 DLL

Credential Access

T1539 Steal Web Session CookieT1555 Credentials from Password Stores

Discovery

T1497.001 System Checks

Command & Control

T1105 Ingress Tool TransferT1219.002 Remote Desktop Software

Toolsets (3)

🐛

EVILNUM S0568

Malware · Windows

🐛

More_eggs S0284

Malware · Windows

🔧

LaZagne S0349

Tool · Linux, macOS, Windows

References & Reports (1)

Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.

↑