Evilnum
IntrusionSet · ATTACK:enterprise:G0120
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0120",
"title": "Evilnum",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0120",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--1f0f9a14-11aa-49aa-9174-bcd0eaa979de",
"external_id": "G0120",
"domain": "enterprise",
"created": "2021-01-22T16:46:17.790Z",
"modified": "2026-07-31T18:47:41.686Z",
"version": "1.0",
"aliases": [
"Evilnum"
],
"tactics": [
],
"source_references": [
{
"source_name": "Evilnum"
},
{
"source_name": "ESET EvilNum July 2020",
"url": "https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1646da26-9846-4a24-b9a6-59ebad8c9cb5
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:S0284
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17fc72c1-83be-4dce-a795-d2a36e6354ca
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a5341b9-e987-4687-b8f2-6c798f1ac0ae
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1539
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fd05c59-c28b-418a-be56-87ff52d4771c
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--478e4f65-d03a-4f1b-aeeb-16dddc1bfead
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--497c12c8-1cdf-4c1e-9624-83438ef770a2
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65ce8ea7-b997-4bb3-8fb4-9259567f492b
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67f7ebd0-effb-4169-a184-7d45c614a6ee
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c0ae1dc-2429-42fd-899e-8aafb9adc50c
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:S0568
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81cf0260-877d-47ba-b98d-5d2cea453cdf
Prevailion EvilNum May 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b914660-657e-4f6e-a9be-ed51c840875e
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--acdab071-f314-4671-a794-3c792b559c28
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:S0349
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0a10dc5-51e4-4ec3-a827-4999bde3ed58
ESET EvilNum July 2020ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea3b16db-6b34-4171-9dec-7ce618f49dee
ESET EvilNum July 2020