MITRE ATT&CKsoftware (malware)
S1226 BOOKWORM
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2025-07-21
Description
BOOKWORM is a modular trojan known to be leveraged by Mustang Panda and was first observed utilized in 2015. BOOKWORM was later updated in late 2021 and the fall of 2022 to launch shellcode represented as UUID parameters.
Related
Uses · MITRE ATT&CK (17)
- T1027.013 Encrypted/Encoded File sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1071.001 Web Protocols sub-technique
- T1564.003 Hidden Window sub-technique
- T1574.001 DLL sub-technique
- T1056.001 Keylogging sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1553.002 Code Signing sub-technique
- T1070.006 Timestomp sub-technique
- T1543.003 Windows Service sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
- T1106 Native API technique
- T1112 Modify Registry technique
- T1115 Clipboard Data technique
Referenced by MITRE ATT&CK · uses (1)
- G0129 Mustang Panda group
References
- https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia Broadcom
- https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/ Unit42 Bookworm Nov2015
- https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/ Palo Alto Networks, Unit 42