H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

EVILNUM

[EVILNUM](https://attack.mitre.org/software/S0568) is fully capable backdoor that was first identified in 2018. [EVILNUM](https://attack.mitre.org/software/S0568) is used by the APT group [Evilnum](https://attack.mitre.org/groups/G0120) which has the same name.(Citation: ESET EvilNum July 2020)(Citation: Prevailion EvilNum May 2020)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[EVILNUM](https://attack.mitre.org/software/S0568) is fully capable backdoor that was first identified in 2018. [EVILNUM](https://attack.mitre.org/software/S0568) is used by the APT group [Evilnum](https://attack.mitre.org/groups/G0120) which has the same name.(Citation: ESET EvilNum July 2020)(Citation: Prevailion EvilNum May 2020)

Labels

malware
15 recorded

Relationships

uses
from Evilnum
Group
uses
to Exfiltration Over C2 Channel
Technique
uses
to Indicator Removal
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Modify Registry
Technique
uses
to One-Way Communication
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Regsvr32
Technique
uses
to Rundll32
Technique
uses
to Security Software Discovery
Technique
uses
to Steal Web Session Cookie
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Timestomp
Technique
uses
to Windows Management Instrumentation
Technique
4 external

References

mitre-attack
S0568
open
EVILNUM
—
Prevailion EvilNum May 2020
https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/
open
ESET EvilNum July 2020
https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance