Cyber Resilience

Threat actor · all actors

EvilnumG0120 unknown

aka Evilnum, DeathStalker, TA4563, Jointworm, KNOCKOUT SPIDER

Last updated: 2026-08-20

0attributed CVEs
19ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active

About this actor

ESET has analyzed the operations of Evilnum, the APT group behind the Evilnum malware previously seen in attacks against financial technology companies. While said malware has been seen in the wild since at least 2018 and documented previously, little has been published about the group behind it and how it operates. The group’s targets remain fintech companies, but its toolset and infrastructure have evolved and now consist of a mix of custom, homemade malware combined with tools purchased from Golden Chickens, a Malware-as-a-Service (MaaS) provider whose infamous customers include FIN6 and Cobalt Group.

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G0120

CrowdStrikenation-animal names

KNOCKOUT SPIDER

ProofpointTA threat-actor id

TA4563

Unclassifiedno scheme matched

EvilnumDeathStalkerJointworm

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 19 ATT&CK techniques on file.
Named victims
None on file.

See how actor data is built for the full pipeline.

Activity timeline

No activity events recorded.

Profile

CVERiskCVSSEPSSPublishedProducts
No attributed CVEs.

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
SI-415 / 1979%
CM-214 / 1974%
CM-614 / 1974%
CA-713 / 1968%
SI-313 / 1968%
AC-39 / 1947%
CM-79 / 1947%
SI-29 / 1947%
AC-68 / 1942%
SI-78 / 1942%
AC-47 / 1937%
RA-57 / 1937%
AC-26 / 1932%
SC-76 / 1932%
SI-106 / 1932%

Co-occurring actors

None.

Similar actors

Similar TTPs