Evilnum - G0120

Created: 2021-01-22T16:46:17.790Z

Modified: 2021-04-27T19:55:58.323Z

Contributors:

Aliases

Evilnum

Description

Evilnum is a financially motivated threat group that has been active since at least 2018.(Citation: ESET EvilNum July 2020)

Techniques Used

Evilnum can deploy additional components or tools as needed.(Citation: ESET EvilNum July 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.(Citation: ESET EvilNum July 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.(Citation: ESET EvilNum July 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1497.001|System Checks|

Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments. (Citation: ESET EvilNum July 2020)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

Evilnum has used PowerShell to bypass UAC.(Citation: ESET EvilNum July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Evilnum has deleted files used during infection.(Citation: ESET EvilNum July 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|