{
  "aliases": [],
  "attack_id": "G0120",
  "attack_name": "Evilnum",
  "attack_url": "https://attack.mitre.org/groups/G0120/",
  "counts": {
    "domain": 167,
    "ipv4": 4,
    "url": 15
  },
  "first_seen": {
    "domain": {
      "admex.org": "2022-08-10",
      "adsoftpic.com": "2022-08-10",
      "affijay.com": "2022-08-10",
      "agagian.com": "2022-08-10",
      "aidobe-update.com": "2022-08-10",
      "allmedicalpro.com": "2020-07-22",
      "allrivercenter.com": "2022-08-10",
      "amazonappservice.com": "2022-08-10",
      "amazoncld.com": "2022-08-10",
      "amazoncontent.org": "2022-08-10",
      "ammaze.org": "2022-08-10",
      "amzbooks.org": "2022-08-10",
      "amznapis.com": "2022-08-10",
      "anyfoodappz.com": "2022-08-10",
      "anypicsave.com": "2022-08-10",
      "apidevops.org": "2022-08-10",
      "apiygate.com": "2022-08-10",
      "appcellor.com": "2022-08-10",
      "apple-sdk.com": "2022-08-10",
      "atomarket.org": "2022-08-10",
      "audio-azure.com": "2021-05-03",
      "azure-affiliate.com": "2021-05-03",
      "azurecfd.com": "2022-08-10",
      "azurecontents.com": "2022-08-10",
      "azureservicesapi.com": "2022-08-10",
      "bookfinder-ltd.com": "2022-08-10",
      "borisjns.com": "2022-08-10",
      "cargoargs.com": "2022-08-10",
      "cashcores.org": "2022-08-10",
      "check-avg.co": "2021-05-03",
      "check-avg.com": "2022-08-10",
      "cloud-appint.com": "2022-08-10",
      "cloudappcer.com": "2022-08-10",
      "cloudazureservices.com": "2022-08-10",
      "cloudpdom.com": "2022-08-10",
      "cloudreg-email.com": "2022-08-10",
      "coreadvc.com": "2022-08-10",
      "corstand.com": "2022-08-10",
      "cosmoscld.com": "2022-08-10",
      "covidaff.org": "2022-08-10",
      "covidgov.org": "2022-08-10",
      "covsafezone.com": "2022-08-10",
      "dbcallog.com": "2022-08-10",
      "dellscanhw.com": "2022-08-10",
      "diamondncenter.biz": "2022-08-10",
      "dnserviceapp.com": "2022-08-10",
      "dnstotal.org": "2022-08-10",
      "dogeofcoin.com": "2022-08-10",
      "dustforms.com": "2022-08-10",
      "earthviehuge.com": "2022-08-10",
      "econfuss.com": "2022-08-10",
      "edwardpof.com": "2022-08-10",
      "eroclasp.com": "2022-08-10",
      "esetupdater.com": "2022-08-10",
      "ezteching.com": "2022-08-10",
      "fastnetbrowsing.com": "2022-08-10",
      "findmypcs.com": "2022-08-10",
      "firedomez.com": "2022-08-10",
      "flightpassist.com": "2022-08-10",
      "flyingpackagetrack.com": "2022-08-10",
      "footersig.pythonanywhere.com": "2020-12-04",
      "forceground.co": "2022-08-10",
      "futureggs.com": "2022-08-10",
      "getappcloud.com": "2022-08-10",
      "globalsignature.pythonanywhere.com": "2020-12-04",
      "gofinancesolutions.com": "2020-12-04",
      "govdefi.com": "2022-08-10",
      "govtoffice.org": "2022-08-10",
      "gratedomofrome.com": "2022-08-10",
      "hostboxapp.com": "2022-08-10",
      "hostedl.com": "2022-08-10",
      "hpcloudlive.com": "2022-08-10",
      "ihotel-deals.com": "2022-08-10",
      "invgov.org": "2022-08-10",
      "jarviservice.org": "2022-08-10",
      "luccares.com": "2022-08-10",
      "mailcloudservices.org": "2022-08-10",
      "mailservice.pythonanywhere.com": "2020-12-04",
      "mailservicenow.com": "2022-08-10",
      "mailservices.pythonanywhere.com": "2020-12-04",
      "mailsignature.pythonanywhere.com": "2020-12-04",
      "mailsigning.pythonanywhere.com": "2020-12-04",
      "mainsingular.com": "2022-08-10",
      "mcafee-secd.com": "2022-08-10",
      "mediqhealthcare.com": "2020-12-04",
      "mevcsft.com": "2022-08-10",
      "missft.com": "2022-08-10",
      "msfastbrowse.com": "2022-08-10",
      "msfsvctassist.com": "2022-08-10",
      "msft-dev.com": "2022-08-10",
      "msftapp.com": "2022-08-10",
      "msftcd.com": "2022-08-10",
      "msftcrs.com": "2022-08-10",
      "msftinfo.com": "2022-08-10",
      "msftmnvm.com": "2022-08-10",
      "msftprint.com": "2022-08-10",
      "msintsvc.com": "2022-08-10",
      "mslogger.org": "2022-08-10",
      "mullticon.com": "2022-08-10",
      "multitrolli.com": "2022-08-10",
      "multizoom.org": "2022-08-10",
      "murfyslaws.com": "2022-08-10",
      "musthavethisapp.com": "2022-08-10",
      "n90app.com": "2022-08-10",
      "namereslv.org": "2022-08-10",
      "navyedu.org": "2022-08-10",
      "netmsvc.com": "2022-08-10",
      "networkcanner.com": "2022-08-10",
      "newedgeso.com": "2022-08-10",
      "ntlmsvc.com": "2022-08-10",
      "nvidiaupdater.com": "2022-08-10",
      "oglmart.com": "2022-08-10",
      "onesportinc.com": "2022-08-10",
      "orklaus.com": "2022-08-10",
      "outlooksyn.com": "2022-08-10",
      "pdfscan-now.com": "2022-08-10",
      "philipfin.com": "2022-08-10",
      "picodehub.com": "2022-08-10",
      "pinktwinlers.com": "2022-08-10",
      "pivotnet.org": "2022-08-10",
      "plancetron.com": "2022-08-10",
      "poccodom.com": "2022-08-10",
      "praxpay.org": "2022-08-10",
      "print-hpcloud.com": "2022-08-10",
      "printauthors.com": "2022-08-10",
      "prodeload.com": "2022-08-10",
      "questofma.com": "2022-08-10",
      "realmacblog.com": "2022-08-10",
      "realshbe.com": "2022-08-10",
      "refsurface.com": "2022-08-10",
      "robmkg.com": "2022-08-10",
      "roboecloud.com": "2022-08-10",
      "rombaic.com": "2022-08-10",
      "rowfus.com": "2022-08-10",
      "scan-eset.com": "2021-05-03",
      "sellcoread.com": "2022-08-10",
      "service-azure.com": "2021-05-03",
      "servicebu.org": "2022-08-10",
      "servicejap.com": "2022-08-10",
      "shopadvs.com": "2022-08-10",
      "shopamzn.org": "2022-08-10",
      "soundstuner.com": "2022-08-10",
      "superimarkets.com": "2022-08-10",
      "svclouds.com": "2022-08-10",
      "svcscom.com": "2022-08-10",
      "symantecq.com": "2022-08-10",
      "sysconfwmi.com": "2022-08-10",
      "textmaticz.com": "2022-08-10",
      "thesailormaid.com": "2022-08-10",
      "thismads.com": "2022-08-10",
      "timetwork.com": "2022-08-10",
      "tomandos.com": "2022-08-10",
      "tophubbyriver.com": "2022-08-10",
      "topotato.org": "2022-08-10",
      "totaledgency.com": "2022-08-10",
      "unitedubai.org": "2022-08-10",
      "unitepixel.org": "2022-08-10",
      "wdigitalecloud.com": "2022-08-10",
      "weareukrainepeople.com": "2022-08-10",
      "weatherlocate.com": "2022-08-10",
      "windowslive-detect.com": "2022-08-10",
      "wingsnsun.com": "2022-08-10",
      "wizdomofdo.com": "2022-08-10",
      "wwcsport.org": "2022-08-10",
      "yourprintllc.com": "2022-08-10",
      "zerobitfan.com": "2022-08-10",
      "zummaride.com": "2022-08-10"
    },
    "ipv4": {
      "176.223.165.196:8080": "2022-12-08",
      "185.62.189.210:8081": "2022-12-08",
      "87.120.254.100:8080": "2022-12-08",
      "87.120.37.68:8080": "2022-12-08"
    },
    "url": {
      "gsn-nettoyage.com/wp-snapshots/": "2020-12-04",
      "http://105.104.10.115": "2020-08-24",
      "http://176.223.165.196": "2022-12-08",
      "http://54.38.192.174": "2020-08-24",
      "http://87.120.254.100": "2022-12-08",
      "http://87.120.37.68": "2022-12-08",
      "http://87.121.52.62": "2020-08-24",
      "http://87.121.52.69": "2020-08-24",
      "http://91.229.76.153": "2020-08-24",
      "http://91.229.76.17": "2020-08-24",
      "http://91.229.77.120": "2020-08-24",
      "http://91.229.77.240": "2020-08-24",
      "http://91.229.79.120": "2020-08-24",
      "http://94.156.77.182": "2020-08-24",
      "http://95.211.168.10": "2020-08-24"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2020-07-22",
    "latest": "2022-12-08"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "admex.org",
      "adsoftpic.com",
      "affijay.com",
      "agagian.com",
      "aidobe-update.com",
      "allmedicalpro.com",
      "allrivercenter.com",
      "amazonappservice.com",
      "amazoncld.com",
      "amazoncontent.org",
      "ammaze.org",
      "amzbooks.org",
      "amznapis.com",
      "anyfoodappz.com",
      "anypicsave.com",
      "apidevops.org",
      "apiygate.com",
      "appcellor.com",
      "apple-sdk.com",
      "atomarket.org",
      "audio-azure.com",
      "azure-affiliate.com",
      "azurecfd.com",
      "azurecontents.com",
      "azureservicesapi.com",
      "bookfinder-ltd.com",
      "borisjns.com",
      "cargoargs.com",
      "cashcores.org",
      "check-avg.co",
      "check-avg.com",
      "cloud-appint.com",
      "cloudappcer.com",
      "cloudazureservices.com",
      "cloudpdom.com",
      "cloudreg-email.com",
      "coreadvc.com",
      "corstand.com",
      "cosmoscld.com",
      "covidaff.org",
      "covidgov.org",
      "covsafezone.com",
      "dbcallog.com",
      "dellscanhw.com",
      "diamondncenter.biz",
      "dnserviceapp.com",
      "dnstotal.org",
      "dogeofcoin.com",
      "dustforms.com",
      "earthviehuge.com",
      "econfuss.com",
      "edwardpof.com",
      "eroclasp.com",
      "esetupdater.com",
      "ezteching.com",
      "fastnetbrowsing.com",
      "findmypcs.com",
      "firedomez.com",
      "flightpassist.com",
      "flyingpackagetrack.com",
      "footersig.pythonanywhere.com",
      "forceground.co",
      "futureggs.com",
      "getappcloud.com",
      "globalsignature.pythonanywhere.com",
      "gofinancesolutions.com",
      "govdefi.com",
      "govtoffice.org",
      "gratedomofrome.com",
      "hostboxapp.com",
      "hostedl.com",
      "hpcloudlive.com",
      "ihotel-deals.com",
      "invgov.org",
      "jarviservice.org",
      "luccares.com",
      "mailcloudservices.org",
      "mailservice.pythonanywhere.com",
      "mailservicenow.com",
      "mailservices.pythonanywhere.com",
      "mailsignature.pythonanywhere.com",
      "mailsigning.pythonanywhere.com",
      "mainsingular.com",
      "mcafee-secd.com",
      "mediqhealthcare.com",
      "mevcsft.com",
      "missft.com",
      "msfastbrowse.com",
      "msfsvctassist.com",
      "msft-dev.com",
      "msftapp.com",
      "msftcd.com",
      "msftcrs.com",
      "msftinfo.com",
      "msftmnvm.com",
      "msftprint.com",
      "msintsvc.com",
      "mslogger.org",
      "mullticon.com",
      "multitrolli.com",
      "multizoom.org",
      "murfyslaws.com",
      "musthavethisapp.com",
      "n90app.com",
      "namereslv.org",
      "navyedu.org",
      "netmsvc.com",
      "networkcanner.com",
      "newedgeso.com",
      "ntlmsvc.com",
      "nvidiaupdater.com",
      "oglmart.com",
      "onesportinc.com",
      "orklaus.com",
      "outlooksyn.com",
      "pdfscan-now.com",
      "philipfin.com",
      "picodehub.com",
      "pinktwinlers.com",
      "pivotnet.org",
      "plancetron.com",
      "poccodom.com",
      "praxpay.org",
      "print-hpcloud.com",
      "printauthors.com",
      "prodeload.com",
      "questofma.com",
      "realmacblog.com",
      "realshbe.com",
      "refsurface.com",
      "robmkg.com",
      "roboecloud.com",
      "rombaic.com",
      "rowfus.com",
      "scan-eset.com",
      "sellcoread.com",
      "service-azure.com",
      "servicebu.org",
      "servicejap.com",
      "shopadvs.com",
      "shopamzn.org",
      "soundstuner.com",
      "superimarkets.com",
      "svclouds.com",
      "svcscom.com",
      "symantecq.com",
      "sysconfwmi.com",
      "textmaticz.com",
      "thesailormaid.com",
      "thismads.com",
      "timetwork.com",
      "tomandos.com",
      "tophubbyriver.com",
      "topotato.org",
      "totaledgency.com",
      "unitedubai.org",
      "unitepixel.org",
      "wdigitalecloud.com",
      "weareukrainepeople.com",
      "weatherlocate.com",
      "windowslive-detect.com",
      "wingsnsun.com",
      "wizdomofdo.com",
      "wwcsport.org",
      "yourprintllc.com",
      "zerobitfan.com",
      "zummaride.com"
    ],
    "ipv4": [
      "176.223.165.196:8080",
      "185.62.189.210:8081",
      "87.120.254.100:8080",
      "87.120.37.68:8080"
    ],
    "url": [
      "gsn-nettoyage.com/wp-snapshots/",
      "http://105.104.10.115",
      "http://176.223.165.196",
      "http://54.38.192.174",
      "http://87.120.254.100",
      "http://87.120.37.68",
      "http://87.121.52.62",
      "http://87.121.52.69",
      "http://91.229.76.153",
      "http://91.229.76.17",
      "http://91.229.77.120",
      "http://91.229.77.240",
      "http://91.229.79.120",
      "http://94.156.77.182",
      "http://95.211.168.10"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "DEATHSTALKER"
  ],
  "references": [
    "https://archive.f-secure.com/weblog/archives/00002803.html",
    "https://otx.alienvault.com/pulse/5f43eff7af4508bf663e17ea",
    "https://otx.alienvault.com/pulse/5fc9193078e666899f4cc5a7",
    "https://securelist.com/deathstalker-mercenary-triumvirate/98177/",
    "https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131/",
    "https://securelist.com/vilerat-deathstalkers-continuous-strike/107075/",
    "https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/ (# PowerPepper)",
    "https://twitter.com/z0ul_/status/1389328825855746051 (# PyVil RAT)"
  ],
  "related": [],
  "slug": "G0120",
  "timeline": [
    {
      "counts": {
        "ipv4": 4,
        "url": 3
      },
      "first_seen": "2022-12-08",
      "indicators": {
        "ipv4": [
          "176.223.165.196:8080",
          "185.62.189.210:8081",
          "87.120.254.100:8080",
          "87.120.37.68:8080"
        ],
        "url": [
          "http://176.223.165.196",
          "http://87.120.254.100",
          "http://87.120.37.68"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131/"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 153
      },
      "first_seen": "2022-08-10",
      "indicators": {
        "domain": [
          "admex.org",
          "adsoftpic.com",
          "affijay.com",
          "agagian.com",
          "aidobe-update.com",
          "allrivercenter.com",
          "amazonappservice.com",
          "amazoncld.com",
          "amazoncontent.org",
          "ammaze.org",
          "amzbooks.org",
          "amznapis.com",
          "anyfoodappz.com",
          "anypicsave.com",
          "apidevops.org",
          "apiygate.com",
          "appcellor.com",
          "apple-sdk.com",
          "atomarket.org",
          "azurecfd.com",
          "azurecontents.com",
          "azureservicesapi.com",
          "bookfinder-ltd.com",
          "borisjns.com",
          "cargoargs.com",
          "cashcores.org",
          "check-avg.com",
          "cloud-appint.com",
          "cloudappcer.com",
          "cloudazureservices.com",
          "cloudpdom.com",
          "cloudreg-email.com",
          "coreadvc.com",
          "corstand.com",
          "cosmoscld.com",
          "covidaff.org",
          "covidgov.org",
          "covsafezone.com",
          "dbcallog.com",
          "dellscanhw.com",
          "diamondncenter.biz",
          "dnserviceapp.com",
          "dnstotal.org",
          "dogeofcoin.com",
          "dustforms.com",
          "earthviehuge.com",
          "econfuss.com",
          "edwardpof.com",
          "eroclasp.com",
          "esetupdater.com",
          "ezteching.com",
          "fastnetbrowsing.com",
          "findmypcs.com",
          "firedomez.com",
          "flightpassist.com",
          "flyingpackagetrack.com",
          "forceground.co",
          "futureggs.com",
          "getappcloud.com",
          "govdefi.com",
          "govtoffice.org",
          "gratedomofrome.com",
          "hostboxapp.com",
          "hostedl.com",
          "hpcloudlive.com",
          "ihotel-deals.com",
          "invgov.org",
          "jarviservice.org",
          "luccares.com",
          "mailcloudservices.org",
          "mailservicenow.com",
          "mainsingular.com",
          "mcafee-secd.com",
          "mevcsft.com",
          "missft.com",
          "msfastbrowse.com",
          "msfsvctassist.com",
          "msft-dev.com",
          "msftapp.com",
          "msftcd.com",
          "msftcrs.com",
          "msftinfo.com",
          "msftmnvm.com",
          "msftprint.com",
          "msintsvc.com",
          "mslogger.org",
          "mullticon.com",
          "multitrolli.com",
          "multizoom.org",
          "murfyslaws.com",
          "musthavethisapp.com",
          "n90app.com",
          "namereslv.org",
          "navyedu.org",
          "netmsvc.com",
          "networkcanner.com",
          "newedgeso.com",
          "ntlmsvc.com",
          "nvidiaupdater.com",
          "oglmart.com",
          "onesportinc.com",
          "orklaus.com",
          "outlooksyn.com",
          "pdfscan-now.com",
          "philipfin.com",
          "picodehub.com",
          "pinktwinlers.com",
          "pivotnet.org",
          "plancetron.com",
          "poccodom.com",
          "praxpay.org",
          "print-hpcloud.com",
          "printauthors.com",
          "prodeload.com",
          "questofma.com",
          "realmacblog.com",
          "realshbe.com",
          "refsurface.com",
          "robmkg.com",
          "roboecloud.com",
          "rombaic.com",
          "rowfus.com",
          "sellcoread.com",
          "servicebu.org",
          "servicejap.com",
          "shopadvs.com",
          "shopamzn.org",
          "soundstuner.com",
          "superimarkets.com",
          "svclouds.com",
          "svcscom.com",
          "symantecq.com",
          "sysconfwmi.com",
          "textmaticz.com",
          "thesailormaid.com",
          "thismads.com",
          "timetwork.com",
          "tomandos.com",
          "tophubbyriver.com",
          "topotato.org",
          "totaledgency.com",
          "unitedubai.org",
          "unitepixel.org",
          "wdigitalecloud.com",
          "weareukrainepeople.com",
          "weatherlocate.com",
          "windowslive-detect.com",
          "wingsnsun.com",
          "wizdomofdo.com",
          "wwcsport.org",
          "yourprintllc.com",
          "zerobitfan.com",
          "zummaride.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/vilerat-deathstalkers-continuous-strike/107075/"
      ],
      "total": 153
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2021-05-03",
      "indicators": {
        "domain": [
          "audio-azure.com",
          "azure-affiliate.com",
          "check-avg.co",
          "scan-eset.com",
          "service-azure.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/z0ul_/status/1389328825855746051 (# PyVil RAT)"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 8,
        "url": 1
      },
      "first_seen": "2020-12-04",
      "indicators": {
        "domain": [
          "footersig.pythonanywhere.com",
          "globalsignature.pythonanywhere.com",
          "gofinancesolutions.com",
          "mailservice.pythonanywhere.com",
          "mailservices.pythonanywhere.com",
          "mailsignature.pythonanywhere.com",
          "mailsigning.pythonanywhere.com",
          "mediqhealthcare.com"
        ],
        "url": [
          "gsn-nettoyage.com/wp-snapshots/"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/ (# PowerPepper)",
        "https://otx.alienvault.com/pulse/5fc9193078e666899f4cc5a7"
      ],
      "total": 9
    },
    {
      "counts": {
        "url": 11
      },
      "first_seen": "2020-08-24",
      "indicators": {
        "url": [
          "http://105.104.10.115",
          "http://54.38.192.174",
          "http://87.121.52.62",
          "http://87.121.52.69",
          "http://91.229.76.153",
          "http://91.229.76.17",
          "http://91.229.77.120",
          "http://91.229.77.240",
          "http://91.229.79.120",
          "http://94.156.77.182",
          "http://95.211.168.10"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/deathstalker-mercenary-triumvirate/98177/",
        "https://otx.alienvault.com/pulse/5f43eff7af4508bf663e17ea",
        "https://archive.f-secure.com/weblog/archives/00002803.html"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-07-22",
      "indicators": {
        "domain": [
          "allmedicalpro.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/what-did-deathstalker-hide-between-two-ferns/99616/ (# PowerPepper)",
        "https://otx.alienvault.com/pulse/5fc9193078e666899f4cc5a7"
      ],
      "total": 1
    }
  ]
}