Evilnum
Evilnum is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 5 sectors, including Government and Technology, in 31 countries, including the United States and the United Kingdom. It uses 44 MITRE ATT&CK techniques.
Also known as
- Jointworm
- TA4563
- G0120
- Operation “Phantom in the [Command] Shell”
- Techniques
- 44
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2018
- Last seen
- Jul 9, 2020
- Record updated
Who They Target.
Sectors · 5
Countries · 31
Labelsglobal
About Evilnum.
Evilnum is a financially motivated threat group that has been active since at least 2018.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.