File · Orangeworm · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
Orangeworm
attack rose · 2 techniques across 2 tactics
Analyst brief
misp-galaxy + mitre-attackSymantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, Europe, and Asia. First identified in January 2015, Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims. Known victims include healthcare providers, pharmaceuticals, IT solution providers for healthcare and equipment manufacturers that serve the healthcare industry, likely for the purpose of corporate espionage.
Kill chain
MITRE ATT&CK Enterprise · tap a technique2 techniques · 2 of 15 tactics
Lateral movement
1 techniqueCommand and control
1 technique
select a technique
Arsenal
1 malware · 7 tools| Malware · 1 | ATT&CK |
|---|---|
| Kwampirs | S0236 ↗ |
as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
4 sourcesTrack Orangeworm on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.