ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented previously, little has been published about the group behind it and how it operates. The group’s targets remain fintech companies, but its toolset and infrastructure have evolved and now consist of a mix of custom, homemade malware combined with tools purchased from Golden Chickens, a Malware-as-a-Service (MaaS) provider whose infamous customers include FIN6 and Cobalt Group.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | DeathStalker |
| OSINT | TA4563 |
| OSINT | EvilNum |
| OSINT | Jointworm |
| OSINT | KNOCKOUT SPIDER |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Evilnum, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Evilnum. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.