Orangeworm
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--5636b7b3-d99b-4edd-aa05-ee649c1d4ef1
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T20:34:00+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (2)
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SM
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with exi
Software & Tools (8)
Arp displays and modifies information about a system's Address Resolution Protocol (ARP) cache. (Citation:
Kwampirs is a backdoor Trojan used by Orangeworm. [Kwampirs](https
The Net utility is a component of the Windows operating system. It is used in command-line operations for c
Systeminfo is a Windows utility that can be used to gather detailed information about a computer. (Citation
cmd is the Windows command-line interpreter that can be used to interact with systems and execute other pro
ipconfig is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and
netstat is an operating system utility that displays active TCP connections, listening ports, and network s
route can be used to find or change information within the local system IP routing table. (Citation: TechNe
Explore this actor's full graph with Ninja Signal