Evilnum — ATT&CK profile, 11 techniques

Overview

Evilnum is a financially motivated threat group that has been active since at least 2018.

Naming & attribution

It uses 11 documented ATT&CK techniques — more than 32% of the 174 groups tracked here. Activity attributed since at least 2018.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Evilnum	Porolli, M

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

TA577 — 3 shared techniques (21% overlap)
Elderwood China — 3 shared techniques (18% overlap)
Molerats — 4 shared techniques (17% overlap)
WIRTE — 5 shared techniques (16% overlap)
Cobalt Group — 6 shared techniques (15% overlap)
LuminousMoth China — 5 shared techniques (15% overlap)

TTPs — 11 techniques across 6 tactics

Initial Access

T1566.002 Spearphishing Link

Execution

T1059.007 JavaScript
T1204.001 Malicious Link

Privilege Escalation

T1548.002 Bypass User Account Control

Stealth

T1070.004 File Deletion
T1497.001 System Checks
T1574.001 DLL

Credential Access

T1539 Steal Web Session Cookie
T1555 Credentials from Password Stores

Command and Control

T1105 Ingress Tool Transfer
T1219.002 Remote Desktop Software

Tools & malware (3)

More_eggs · EVILNUM · LaZagne

Reporting (1)

More evil: A deep look at Evilnum and its toolset — Porolli, M