Loading threat actor…
Just Evil is a hacktivist subgroup associated with the post-split KillNet ecosystem and linked to Killmilk. It emerged as one of three factions formed from the fragmentation of the original pro-Russia KillNet network, alongside Deanon and KillNet 2.0. The group is part of a broader Russian-aligned hacktivist milieu that has supported politically motivated cyber operations tied to geopolitical conflicts involving Ukraine, NATO, Israel, and their perceived supporters. Just Evil has been publicly connected to disruptive operations against internet-connected infrastructure, including attacks on solar-sector monitoring environments. Reported activity includes targeting the solar monitoring system used by Lithuania’s Ignitis Group and association with botnet-linked device hijacking affecting solar-related monitoring infrastructure in Japan. Within the wider KillNet-aligned ecosystem, affiliated actors have emphasized disruptive cyber actions, especially distributed denial-of-service operations, while also claiming intrusion and data-compromise capabilities. High-confidence reporting supports Just Evil’s alignment with hacktivist operations focused on politically motivated disruption rather than financially motivated ransomware activity. The group’s known behavior places it in the category of ideologically and geopolitically driven disruptive actors targeting exposed online systems and critical-adjacent infrastructure. Its association with the KillNet lineage indicates overlap with pro-Russia influence and attack narratives, and with campaigns directed at government and allied targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist activity targeting solar monitoring/management systems, with at least one cited operation against the solar monitoring system used by Lithuania’s Ignitis Group.
Just Evil is linked to botnet operations that compromised hundreds of solar power devices in Japan in 2024, leveraging vulnerabilities in these systems.
Just Evil is a new hacktivist group introduced by Killmilk, expanding the influence of the original Killnet. It is one of the three main factions resulting from the split of the original Killnet group.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.