- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0120 · 11 techniques
- Sources
- 11 sources carry it
- Identifier
- GINC-APT-0045 · evilnum
What it is
Evilnum is a financially motivated threat group that has been active since at least 2018.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Knockout Spider
- MITRE ATT&CK
- G0120
- Proofpoint
- TA4563
- Operations
- Operation “Phantom in the [Command] Shell”
- Other names
- Deceptikons, Wild Neutron, WildNeutron, Butterfly, DeathStalker, Decepticons, Deceptikons, DeathStalker, Jointworm, Jripbot, Morpho, Sphinx Moth, The Postal Group, Wild Neutron, Butterfly, Sphinx Moth
Targets
- Countries
- Albania, Algeria, Argentina, Australia, Austria, Belgium, Canada, China, Cyprus, Czech, France, Germany, India, Israel, Italy, Jordan, Kazakhstan, Lebanon, Palestine, Poland, Russia, Slovenia, Spain, Switzerland, Taiwan, Türkiye, Ukraine, United Arab Emirates, United Kingdom, United States
- Sectors
- Financial, Government, Healthcare, IT
Tools
The tools and malware families the sources tie to it.
- Bypass-UAC
- Cardinal RAT
- ChromeCookiesView
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- EVILNUM
- Evilnum
- GOlden Phoenix
- HesperBot
- IronPython
- JripBot
- LaZagne
- MailPassView
- More_eggs
- ProduKey
- PyVil RAT
- TerraPreter
- TerraStealer
- TerraTV
- Windows Remote Desktop
- many 0-days vulnerabilities
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de