Just Evil
Just Evil is a hacktivist group linked to Killmilk and identified as one of three factions that emerged from the split of the original KillNet group, alongside Deanon and KillNet 2.0. The available content places it within a broader pro-Russia hacktivist ecosystem associated with KillNet’s influence. Just Evil is described as having been introduced by Killmilk as a new hacktivist group and as expanding KillNet’s influence. Observed activity in the provided content includes targeting the solar monitoring system used by Lithuania’s Ignitis Group, and being tied to botnet activity in Japan in 2024 in which hundreds of devices were hijacked. The content also references Just Evil in connection with attacks on renewable-energy-related infrastructure, specifically solar monitoring environments. Known alias in the provided content: just_evil. Related groups and sub-groups directly mentioned in the content: KillNet, KillNet 2.0, and Deanon. The content does not provide high-confidence detail on Just Evil’s full independent targeting scope, malware/tooling, or specific TTPs beyond its hacktivist affiliation, linkage to Killmilk, and involvement in the cited incidents.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- energy
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist activity targeting solar monitoring/management systems, with at least one cited operation against the solar monitoring system used by Lithuania’s Ignitis Group.
Just Evil is linked to botnet operations that compromised hundreds of solar power devices in Japan in 2024, leveraging vulnerabilities in these systems.
Just Evil is a new hacktivist group introduced by Killmilk, expanding the influence of the original Killnet. It is one of the three main factions resulting from the split of the original Killnet group.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.