Cyber Threat Actor: Dr.evil

The threat actor known by the alias Dr.evil, also observed as Dr.3v1l, has been linked to a single publicly reported cyber incident. The actor’s location has been identified as Iran in open‑source reporting. In February 2014, the actor participated in the compromise of Nepal’s Office of the President website.

During that incident, the actor breached a subpage of the site, extracted administrator credentials from the underlying database, and posted a defacement notice. A second, unidentified individual using an Indian handle subsequently defaced the main homepage, possibly leveraging the exposed credentials or another vulnerability. The website remained inaccessible for more than twenty‑four hours after the initial breach. No political slogans or ideological messages accompanied the defacement, and the reporting source noted that the action appeared intended to showcase technical ability rather than advance a specific agenda. The observed tactics therefore consist of web‑application exploitation, credential dumping, and site defacement, with no malware families or exploit kits mentioned in the available accounts. The Softpedia article covering the event provides the primary open‑source record of the actor’s involvement. No evidence of ransomware, data‑extortion, or persistent backdoors was reported in connection with this breach.

Public sources do not establish any state sponsorship, criminal‑group affiliation, or broader campaign history for Dr.evil beyond the 2014 Nepal incident. Consequently, the actor’s known activity is limited to this single defacement operation, and no additional tools, targets, or objectives have been documented in open‑source literature. The available information therefore describes a lone or loosely affiliated actor operating from Iran who demonstrated web‑site compromise capabilities in a single, non‑politically motivated incident. Because no subsequent operations have been attributed to Dr.evil in publicly available sources, the actor’s current status and capabilities remain unknown. Any assessment of the actor’s broader intent or frequency of activity would require additional verified incidents that have not been documented.