MITRE ATT&CKgroup

G0071 Orangeworm

Published 2018-10-17 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
2.0
Created
2018-10-17

Description

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.

Related

Uses · MITRE ATT&CK (10)

  • T1071.001 Web Protocols sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • S0236 Kwampirs software (malware)
  • S0039 Net software (tool)
  • S0096 Systeminfo software (tool)
  • S0099 Arp software (tool)
  • S0100 ipconfig software (tool)
  • S0103 route software (tool)
  • S0104 netstat software (tool)
  • S0106 cmd software (tool)

References