Cyber Threat Actor: EvoIsGod

The threatactor known as EvoIsGod operates under that alias and is associated with the individual using the handle Cryptolulz666. Public sources indicate the actor is based in Greece. EvoIsGod has been linked to the Powerful Greek Army, a group referenced in connection with Cryptolulz666’s background. The actor’s known targets include media organizations and government websites, as demonstrated by attacks on a Hong Kong newspaper and various state‑related sites. Their stated objectives are to raise cybersecurity awareness and to embarrass the compromised institutions by exposing security flaws. The primary initial access vector observed in their operations is SQL injection against content management systems. After gaining access, they exfiltrate selected data and publish it on public paste sites such as Pastebin. In addition to data leaks, the actor has employed distributed denial‑of‑service (DDoS) attacks against government‑run web services.

One of the most documented operations occurred on December 24, 2016, when EvoIsGod and Cryptolulz666 breached the website of The Standard Hong Kong newspaper via a SQL injection flaw. The attackers accessed a database containing roughly twelve thousand user records and leaked about a quarter of that information on Pastebin, citing legal concerns for withholding the remainder. Prior to the Hong Kong incident, Cryptolulz666 had claimed responsibility for hacking the website of the Russian embassy in Armenia, demonstrating a pattern of targeting diplomatic missions. The same individual also launched DDoS campaigns against the Italian government’s startup visa portal and the website of the Russian Federal Drug Control Service liquidation commission. These activities illustrate a recurring focus on government‑affiliated entities across different regions, using both data‑exfiltration and disruption tactics. No public attributions tie EvoIsGod to a state sponsor or a larger criminal consortium beyond the loose association with the Powerful Greek Army.