Orangeworm
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. [1]
ID: G0071
Contributors: Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre
Version: 1.1
Created: 17 October 2018
Last Modified: 30 March 2020
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Orangeworm has used HTTP for C2.[2] |
Enterprise | T1021 | .002 | Remote Services: SMB/Windows Admin Shares |
Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.[1] |
Software
References
- Symantec Security Response Attack Investigation Team. (2018, April 23). Orangeworm: Indicators of Compromise. Retrieved July 8, 2018.