File · Evilnum · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Evilnum

DeathStalker
TA4563
EvilNum
Jointworm
KNOCKOUT SPIDER

attack rose · 11 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented previously, little has been published about the group behind it and how it operates. The group’s targets remain fintech companies, but its toolset and infrastructure have evolved and now consist of a mix of custom, homemade malware combined with tools purchased from Golden Chickens, a Malware-as-a-Service (MaaS) provider whose infamous customers include FIN6 and Cobalt Group.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

11 techniques · 6 of 15 tactics

Matters for

Initial access
1 technique
Execution
2 techniques
Privilege escalation
1 technique
Stealth
3 techniques
Credential access
2 techniques
Command and control
2 techniques

select a technique

Arsenal

2 malware · 1 tools

Malware
Malware · 2	ATT&CK	Shared by
More_eggs	S0284 ↗	3 actors
EVILNUM	S0568 ↗

Tools
Tools · 1	ATT&CK	Shared by
LaZagne	S0349 ↗	12 actors

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

10 sources

Track Evilnum on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.

Analyst brief

Kill chain

Initial access

Execution

Privilege escalation

Stealth

Credential access

Command and control

Arsenal

Take it with you

References

Track Evilnum on the wire.