- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Unknown
- Motivation
- Information theft and espionage
- Seen
- 2015–2026
- Status
- Active
- ATT&CK
- G0071 · 2 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0067 · orangeworm
What it is
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0071
Targets
- Countries
- Belgium, Brazil, Canada, Chile, China, France, Germany, Hong Kong, Hungary, India, Malaysia, Netherlands, Norway, Philippines, Poland, Saudi Arabia, Spain, Sweden, Switzerland, Türkiye, United Kingdom, United States
- Sectors
- Food and Agriculture, Healthcare, IT, Manufacturing, Shipping and Logistics
Tools
The tools and malware families the sources tie to it.
- Arp
- Backdoor.Oldrea
- Kwampirs
- Kwampirs backdoor
- Living off the Land
- Net
- Systeminfo
- Trojan.Karagany
- Trojan.Mebromi
- UNITEDRAKE
- Unknown Logger
- cmd
- ipconfig
- netstat
- route
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de