Evilnum
No sourced public emblem in this profile.
reference profile · reported nexus: Unknown (not nationality)
ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented previously, little has been published about the group behind it and how it operates. The group’s targets remain fintech companies, but its toolset and infrastructure have evolved and now consist of a mix of custom, homemade malware combined with tools purchased from Golden Chickens, a Malware-as-a-Service (MaaS) provider whose infamous customers include FIN6 and Cobalt Group.
Source-reported aliases: DeathStalker, TA4563, EvilNum, Jointworm, KNOCKOUT SPIDER. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
https://securelist.com/deathstalker-mercenary-triumvirate/98177/
https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/
https://www.rewterz.com/rewterz-news/rewterz-threat-alert-evilnum-apt-group-active-iocs-7
https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf