Orangeworm - G0071

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-26T22:29:09.327Z

Contributors: Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre

Aliases

Orangeworm

Description

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.(Citation: Symantec Orangeworm April 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|Orangeworm has used HTTP for C2.(Citation: Symantec Orangeworm IOCs April 2018)|