G0071 · 2 ATT&CK techniques · 0 correlated reports

Orangeworm

Aliases: None listed

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.

Open interactive actor investigation

ATT&CK techniques

T1071.001
Web ProtocolsT1021.002
SMB/Windows Admin Shares

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research