S0568: EVILNUM

EVILNUM matters because ATT&CK describes it as a Windows backdoor associated with the Evilnum threat group, with related behaviors spanning discovery, persistence, command-and-control, exfiltration, defense evasion, and session-cookie theft. For leaders, the decision value is not the malware name alone; it is whether the organization can prove it would see a Windows host being profiled, made persistent through registry/startup mechanisms, proxy-executing code through trusted Windows binaries, communicating through C2, and moving data out over that same channel.

Executive priority

Prioritize EVILNUM as a coverage-validation case for Windows endpoint resilience, identity/session protection, and SOC/IR readiness. The ATT&CK relationships point to risks that affect continuity and incident decision-making: persistent backdoor access, security-tool discovery, registry modification, use of trusted Windows utilities, web session cookie theft, and exfiltration over C2. Executives should ask whether the SOC can correlate endpoint, registry, process, WMI, browser/session, and network evidence into a defensible incident narrative for audit, containment, and risk acceptance.

Technical view

ATT&CK provides no dedicated detection text for EVILNUM, so defenders should validate coverage against the related techniques on Windows: System Owner/User Discovery, System Information Discovery, Security Software Discovery, WMI execution, Modify Registry, Registry Run Keys/Startup Folder persistence, Regsvr32 and Rundll32 proxy execution, Timestomp, Indicator Removal, Ingress Tool Transfer, One-Way Communication, Exfiltration Over C2 Channel, and Steal Web Session Cookie. Detection engineering should focus on behavior chains rather than a single indicator: discovery followed by registry persistence or proxy execution, then external communications and possible data transfer.

Likely telemetry

Windows endpoint process creation and command-line telemetry, especially for wmic/WMI activity, regsvr32.exe, rundll32.exe, reg.exe, and suspicious child-process relationships
Windows Registry auditing or EDR registry-change telemetry for Run keys, startup folder references, and other persistence-related modifications
WMI event logs and remote/local WMI execution traces where collected
File system metadata telemetry that can support timestomp or suspicious file-change analysis
Endpoint security product events, including evidence of security software discovery or tampering attempts where available

Detection direction

Build detections around sequences: host/user/system discovery followed by registry modification, startup persistence, proxy execution via regsvr32 or rundll32, and outbound communications.
Tune trusted-binary detections carefully. Regsvr32 and rundll32 are legitimate Windows utilities, so prioritize unusual command lines, unexpected parent processes, uncommon paths, unsigned or suspicious modules, and execution from user-writable locations.
Validate that WMI execution is visible. Many environments log process starts but miss WMI context, remote origin, or command content, creating a common blind spot.
Correlate endpoint and network evidence for C2 and exfiltration. ATT&CK links EVILNUM to one-way communication, ingress tool transfer, and exfiltration over C2, so network-only or endpoint-only views may be insufficient.
Include identity/session context because the related behavior includes web session cookie theft. Confirm whether browser/session artifacts and anomalous authenticated use can be investigated without over-collecting sensitive data.

Mitigation priorities

Harden Windows persistence paths first: monitor and restrict unauthorized Run key, startup folder, and registry modifications according to business need.
Reduce abuse of trusted Windows utilities by applying application control or policy restrictions where feasible, especially for regsvr32, rundll32, and script/proxy execution patterns.
Improve least-privilege and administrative control over WMI and registry access, including review of who can execute management actions locally or remotely.
Strengthen endpoint and network logging retention so indicator removal or timestamp manipulation does not eliminate the only available evidence.
Protect web sessions through identity controls, session governance, and investigation playbooks for suspected cookie theft or anomalous authenticated access.

Additional notes and limits

The ATT&CK object identifies EVILNUM as a fully capable backdoor first identified in 2018 and used by the Evilnum group, which ATT&CK describes as financially motivated and active since at least 2018. The strongest defensive value comes from the relationship set: the malware is mapped to Windows-relevant discovery, persistence, proxy execution, registry modification, C2, exfiltration, and credential/session-access behaviors.

ATT&CK provides no official detection guidance for this software object and no object-level tactics are specified. Some related ATT&CK techniques list platforms beyond Windows, but the EVILNUM object itself is supplied with Windows as its platform, so local validation should focus on Windows unless other environment evidence justifies broader scope. This take does not assert current exploitation, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

EVILNUM

EVILNUM is fully capable backdoor that was first identified in 2018. EVILNUM is used by the APT group Evilnum which has the same name.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques14 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1102.003	One-Way CommunicationSub-technique	EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.[2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	EVILNUM can achieve persistence through the Registry Run key.[1][2]
Enterprise	T1070	Indicator Removal	EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.[2]
Enterprise	T1082	System Information Discovery	EVILNUM can obtain the computer name from the victim's system.[2]
Enterprise	T1041	Exfiltration Over C2 Channel	EVILNUM can upload files over the C2 channel from the infected host.[2]
Enterprise	T1539	Steal Web Session Cookie	EVILNUM can harvest cookies and upload them to the C2 server.[2]
Enterprise	T1070.006	TimestompSub-technique	EVILNUM has changed the creation date of files.[2]
Enterprise	T1112	Modify Registry	EVILNUM can make modifications to the Regsitry for persistence.[2]
Enterprise	T1105	Ingress Tool Transfer	EVILNUM can download and upload files to the victim's computer.[1][2]
Enterprise	T1033	System Owner/User Discovery	EVILNUM can obtain the username from the victim's machine.[2]
Enterprise	T1218.011	Rundll32Sub-technique	EVILNUM can execute commands and scripts through rundll32.[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	EVILNUM can search for anti-virus products on the system.[2]
Enterprise	T1218.010	Regsvr32Sub-technique	EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.[1]
Enterprise	T1047	Windows Management Instrumentation	EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.[2]

Associated objects

Groups, software, and campaigns

G0120: Evilnum

Evilnum is a financially motivated threat group that has been active since at least 2018.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.0
Created: Jan 28, 2021, 17:24 UTC (UTC+00:00)
Modified: Nov 17, 2024, 23:13 UTC (UTC+00:00)
Raw hash: 981233a34729dceb...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.0	Nov 17, 2024, 23:13 UTC (UTC+00:00)	Current bundle	`981233a34729…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[2]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[3]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[4]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[5]
EVILNUM
(Citation: Prevailion EvilNum May 2020)(Citation: ESET EvilNum July 2020)
[6]
EVILNUM
(Citation: Prevailion EvilNum May 2020)(Citation: ESET EvilNum July 2020)
[7]
EVILNUM
(Citation: Prevailion EvilNum May 2020)(Citation: ESET EvilNum July 2020)
[8]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[9]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[10]
mitre-attackS0568
Open source URL
[11]
mitre-attackS0568
Open source URL
[12]
mitre-attackS0568
Open source URL
[13]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[14]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[15]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[16]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[17]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[18]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[19]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[20]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[21]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[22]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[23]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[24]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[25]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[26]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[27]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[28]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[29]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[30]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[31]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[32]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[33]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[34]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[35]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[36]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[37]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[38]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[39]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[40]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[41]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[42]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL
[43]
ESET EvilNum July 2020
Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
Open source URL
[44]
Prevailion EvilNum May 2020
Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use