Evilnum

Also known as: DeathStalker, Decepticons, EvilNum, Evilnum, G0120, Jointworm, KNOCKOUT SPIDER, Knockout Spider, Operation “Phantom in the [Command] Shell”, TA4563

Evilnum is a financially motivated threat group that has been active since at least 2018. ESET EvilNum July 2020

🌍 Country ["[Unknown]"]
🧭 ATT&CK G0120

Associated Operations

2020-05 2020-08 2021-12 2022 Buy Commodities EvilNum Targets Cryptocurrency Forex In recent weeks Operation “Phantom in the [Command] Shell” Prevailion’s Tailored Intelligence Team has detected two new criminal campaigns targeting the global financial industry with the EVILNUM malware Return of the Evilnum APT with updated TTPs and new targets Sell Steal https://blog.prevailion.com/2020/05/phantom-in-command-shell5.html https://www.cybereason.com/blog/no-rest-for-the-wicked-evilnum-unleashes-pyvil-rat https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets including several notable changes from tactics observed previously. one of which became active on May 3rd 2020. the Nocturnus team has observed new activity by the group

Introduction

Evilnum is a financially motivated threat group that has been active since at least 2018. ESET EvilNum July 2020

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2020-05
  • 2020-08
  • 2021-12
  • 2022
  • Buy
  • Commodities
  • EvilNum Targets Cryptocurrency
  • Forex
  • In recent weeks
  • Operation “Phantom in the [Command] Shell”
  • Prevailion’s Tailored Intelligence Team has detected two new criminal campaigns targeting the global financial industry with the EVILNUM malware
  • Return of the Evilnum APT with updated TTPs and new targets
  • Sell
  • Steal
  • https://blog.prevailion.com/2020/05/phantom-in-command-shell5.html
  • https://www.cybereason.com/blog/no-rest-for-the-wicked-evilnum-unleashes-pyvil-rat
  • https://www.proofpoint.com/us/blog/threat-insight/buy-sell-steal-evilnum-targets-cryptocurrency-forex-commodities
  • https://www.zscaler.com/blogs/security-research/return-evilnum-apt-updated-ttps-and-new-targets
  • including several notable changes from tactics observed previously.
  • one of which became active on May 3rd 2020.
  • the Nocturnus team has observed new activity by the group

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • GOlden Phoenix
  • Cobalt Strike
  • Bypass-UAC:
  • Cardinal RAT:
  • ChromeCookiesView:
  • Evilnum:
  • IronPython:
  • LaZagne:
  • MailPassView:
  • More_eggs:
  • ProduKey:
  • PyVil RAT:
  • TerraPreter:
  • TerraStealer:
  • TerraTV:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

[1] mitre-attack [3] ESET EvilNum July 2020 Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.