Threat actor · all actors
Evil RansomwareMISP-57933295 criminal
aka Evil Ransomware, File0Locked KZ Ransomware
Last updated: 2026-10-16
3attributed CVEs
0ATT&CK techniques
6.6IDF score (tooling uniqueness)
0exclusive CVEs
2021–2023years active
About this actor
It’s directed to English speaking users, therefore is able to infect worldwide. It is spread using email spam, fake updates, attachments and so on. It encrypts all your files, including: music, MS Office, Open Office, pictures, videos, shared online files etc.. Domain KZ is used, therefore it is assumed that the decrypter is from Kazakhstan. Coded in Javascript
How we know this
- Data origin
- MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
- Techniques
- No ATT&CK techniques mapped.
- Named victims
- None on file.
Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.
See how actor data is built for the full pipeline.
Activity timeline
CVE publishedKEV added
- 2023 — 1 CVE published, 1 KEV added
- 2022 — 1 KEV added
- 2021 — 2 CVE published, 1 KEV added
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2021-44228 KEV | 10.0 | 10.0 | 1.0000 | 2021-12-10 | see CVE |
CVE-2021-20038 KEV | 9.9 | 9.8 | 0.9991 | 2021-12-08 | see CVE |
CVE-2022-24990 KEV | 8.5 | 7.5 | 0.9675 | 2023-02-07 | see CVE |
No techniques attributed.
Co-occurring actors
- Maui ransomware 3 shared CVEs
- AnonOps 3 shared CVEs
- COMP-MICROSOFT-SALESFORCE 3 shared CVEs
- Lazarus Group 3 shared CVEs
- l group 3 shared CVEs
- COMP-GOOGLE-CIVIL-DEFENDANT 3 shared CVEs
- Storm-0530 3 shared CVEs
- eCh0raix 3 shared CVEs
- HiddenTear 3 shared CVEs
- red ransomware 3 shared CVEs
Similar actors
Overlapping CVEs
- HiddenTear 1.00
- eCh0raix 1.00
- red ransomware 0.60
- Karakurt 0.33
- COMP-SK-INNOVATION 0.20
Active in same years
Same category
- LAPSUS$ 1.00
- Akira 1.00
- INC Ransom 1.00
- Play 1.00
- BlackByte 1.00