Uptime Hamster: 106d 19h 10mDeploy: 23 Oct 2026 07:21Updated: 2026-07-21
Logo del actor de amenaza KNOCKOUT SPIDER

KNOCKOUT SPIDER

0 incidentes 0 paises 0 sectores apt US Ultimo: -
Aliases: DeathStalker, EvilNum, Jointworm, TA4563
Ver en IntelTracker → APTTrail →
KNOCKOUT SPIDER is an eCrime adversary primarily motivated by financial gain, known for its multi-year operations and adaptive tactics. While referred to by CrowdStrike as KNOCKOUT SPIDER, this group is also recognized under the community identifiers Evilnum, DeathStalker, and TA4563. Unlike groups focused solely on ransomware deployment, KNOCKOUT SPIDER, particularly through its DeathStalker persona, engages in cyber-espionage and data theft, offering 'hacking-for-hire' services. The group also utilizes its Evilnum and TA4563 aliases for campaigns involving customized malware to target financial institutions. It is important not to conflate KNOCKOUT SPIDER with other 'Spider' groups like Wizard Spider, which operates with a different primary toolset and targeting profile.

Aliases del actor

DeathStalkerEvilNumJointwormTA4563

Actores similares

Scattered Spiderthreat-actor · 2doppel-spideractor · 1salty-spideractor · 1brain-spideractor · 1skeleton-spideractor · 1bamboo-spideractor · 1andromeda-spideractor · 1cobalt-spideractor · 1boson-spideractor · 1dextorous-spideractor · 1
Motivacion
Information theft and espionage
Malware asociado
webmonitor, SMOKELOADER, wannacryptor, limerat, Smoke Loader, Agent Tesla
Tecnicas MITRE
T1078.004, T1555, T1006, T1529 - System Shutdown/Reboot, T1566.004, T1543
CVEs relacionadas
CVE-2026-2441, CVE-2026-1340, CVE-2026-1281, CVE-2024-43468
Tipo
apt
Pais origen
US
Motivacion
Information theft and espionage
Impacto
36
Actualizado
Wed, 01 Ju

Sectores objetivo (OSINT)

Rail TransportationHospitalsAccommodationAir TransportationManufacturingConstructionRestaurantsInternet PublishingEnergy & Utilities Insurance