Orangeworm

· ATT&CK GroupG0071

Techniques

Software

Tactics

Aliases

Description

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018) Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.(Citation: Cylera Kwampirs 2022)

Tactic Coverage

lateral movement (1)command and control (1)

Techniques Used (2)

T1021.002SMB/Windows Admin Shares

lateral movement

T1071.001Web Protocols

command and control

Software Used (8)

S0099Arptool S0236Kwampirsmalware S0039Nettool S0096Systeminfotool S0106cmdtool S0100ipconfigtool S0104netstattool S0103route

References (4)

https://attack.mitre.org/groups/G0071 https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia