H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Evilnum](https://attack.mitre.org/groups/G0120) is a financially motivated threat group that has been active since at least 2018.(Citation: ESET EvilNum July 2020)

14 recorded

Relationships

uses

to Bypass User Account Control

Technique

uses

to Credentials from Password Stores

Technique

uses

to DLL

Technique

uses

to EVILNUM

Malware

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to JavaScript

Technique

uses

to LaZagne

Tool

uses

to Malicious Link

Technique

uses

to More_eggs

Malware

uses

to Remote Desktop Software

Technique

uses

to Spearphishing Link

Technique

uses

to Steal Web Session Cookie

Technique

uses

to System Checks

Technique

3 external

References

mitre-attack

G0120

open

Evilnum

—

ESET EvilNum July 2020

https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/

open