Evilnum

Overview

Evilnum is a financially motivated threat group that has been active since at least 2018.

Naming & attribution

It uses 11 documented ATT&CK techniques — more than 32% of the 174 groups tracked here. Activity attributed since at least 2018.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• TA577 — 3 shared techniques (21% overlap)
• Elderwood China — 3 shared techniques (18% overlap)
• Molerats — 4 shared techniques (17% overlap)
• WIRTE — 5 shared techniques (16% overlap)
• Cobalt Group — 6 shared techniques (15% overlap)
• LuminousMoth China — 5 shared techniques (15% overlap)

TTPs — 11 techniques across 6 tactics

Tools & malware (3)

More_eggs · EVILNUM · LaZagne

Reporting (1)

• More evil: A deep look at Evilnum and its toolset — Porolli, M