MITRE ATT&CK / Groups / G0120

Evilnum

ID

G0120

Source

attack.mitre.org

MITRE last modified

1 Aug 2026

Techniques used (11)

• T1059.007 JavaScript
• T1070.004 File Deletion
• T1105 Ingress Tool Transfer
• T1204.001 Malicious Link
• T1219.002 Remote Desktop Software
• T1497.001 System Checks
• T1539 Steal Web Session Cookie
• T1548.002 Bypass User Account Control
• T1555 Credentials from Password Stores
• T1566.002 Spearphishing Link
• T1574.001 DLL

Software used (3)

• S0284 More_eggs
• S0349 LaZagne
• S0568 EVILNUM

References

1. ESET EvilNum July 2020