{
	"id": "ebd9ecf4-425a-4323-8435-e9682c3bc9d5",
	"created_at": "2026-04-06T00:14:00.943731Z",
	"updated_at": "2026-04-10T13:13:01.161091Z",
	"deleted_at": null,
	"sha1_hash": "1b261b26f52b3707f195ee9b041a4a837994d512",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 78879,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 13:45:06 UTC\r\n APT group: Orangeworm\r\nNames\r\nOrangeworm (Symantec)\r\nG0071 (MITRE)\r\nCountry [Unknown]\r\nMotivation Information theft and espionage\r\nFirst seen 2015\r\nDescription (Symantec) Symantec has identified a previously unknown group called\r\nOrangeworm that has been observed installing a custom backdoor called\r\nTrojan.Kwampirs within large international corporations that operate within the\r\nhealthcare sector in the United States, Europe, and Asia.\r\nFirst identified in January 2015, Orangeworm has also conducted targeted attacks\r\nagainst organizations in related industries as part of a larger supply-chain attack in\r\norder to reach their intended victims. Known victims include healthcare providers,\r\npharmaceuticals, IT solution providers for healthcare and equipment manufacturers\r\nthat serve the healthcare industry, likely for the purpose of corporate espionage.\r\nBased on the list of known victims, Orangeworm does not select its targets randomly\r\nor conduct opportunistic hacking. Rather, the group appears to choose its targets\r\ncarefully and deliberately, conducting a good amount of planning before launching\r\nan attack.\r\nAccording to Symantec telemetry, almost 40 percent of Orangeworm’s confirmed\r\nvictim organizations operate within the healthcare industry. The Kwampirs malware\r\nwas found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines. Additionally, Orangeworm\r\nwas observed to have an interest in machines used to assist patients in completing\r\nconsent forms for required procedures. The exact motives of the group are unclear.\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=571b223a-c3cd-4c5c-a4fb-7fa7f3ce4502\r\nPage 1 of 2\n\n(Cylera Labs) At Cylera Labs we assess with medium-high confidence that Shamoon\n(OilRig, APT 34, Helix Kitten, Chrysene) and Kwapirs are the same group or really\nclose collaborators, sharing updates, techniques and code over the course of multiple\nyears.\nObserved\nSectors: Food and Agriculture, Healthcare, IT, Manufacturing, Shipping and\nLogistics.\nCountries: Belgium, Brazil, Canada, Chile, China, France, Germany, Hong Kong,\nHungary, India, Malaysia, Netherlands, Norway, Philippines, Poland, Saudi Arabia,\nSpain, Sweden, Switzerland, Turkey, UK, USA.\nTools used Kwampirs, Living off the Land.\nOperations performed Jan 2020\nThe FBI has issued an alert on Monday about state-sponsored hackers\nusing the Kwampirs malware to attack supply chain companies and\nother industry sectors as part of a global hacking campaign.\nInformation\nMITRE ATT\u0026CK Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=571b223a-c3cd-4c5c-a4fb-7fa7f3ce4502\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=571b223a-c3cd-4c5c-a4fb-7fa7f3ce4502\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=571b223a-c3cd-4c5c-a4fb-7fa7f3ce4502"
	],
	"report_names": [
		"showcard.cgi?u=571b223a-c3cd-4c5c-a4fb-7fa7f3ce4502"
	],
	"threat_actors": [
		{
			"id": "c4acd072-595e-4d33-9ce9-bbf41010bb1a",
			"created_at": "2023-01-06T13:46:38.751893Z",
			"updated_at": "2026-04-10T02:00:03.088252Z",
			"deleted_at": null,
			"main_name": "Orangeworm",
			"aliases": [],
			"source_name": "MISPGALAXY:Orangeworm",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "3e0bc1b7-0dd7-444a-964b-64dfb5145c8f",
			"created_at": "2022-10-25T15:50:23.413202Z",
			"updated_at": "2026-04-10T02:00:05.388465Z",
			"deleted_at": null,
			"main_name": "Orangeworm",
			"aliases": [
				"Orangeworm"
			],
			"source_name": "MITRE:Orangeworm",
			"tools": [
				"Kwampirs",
				"netstat",
				"ipconfig",
				"cmd",
				"Arp",
				"Systeminfo"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "cffb3c01-038f-4527-9cfd-57ad5a035c22",
			"created_at": "2022-10-25T15:50:23.38055Z",
			"updated_at": "2026-04-10T02:00:05.258283Z",
			"deleted_at": null,
			"main_name": "OilRig",
			"aliases": [
				"COBALT GYPSY",
				"IRN2",
				"APT34",
				"Helix Kitten",
				"Evasive Serpens",
				"Hazel Sandstorm",
				"EUROPIUM",
				"ITG13",
				"Earth Simnavaz",
				"Crambus",
				"TA452"
			],
			"source_name": "MITRE:OilRig",
			"tools": [
				"ISMInjector",
				"ODAgent",
				"RDAT",
				"Systeminfo",
				"QUADAGENT",
				"OopsIE",
				"ngrok",
				"Tasklist",
				"certutil",
				"ZeroCleare",
				"POWRUNER",
				"netstat",
				"Solar",
				"ipconfig",
				"LaZagne",
				"BONDUPDATER",
				"SideTwist",
				"OilBooster",
				"SampleCheck5000",
				"PsExec",
				"SEASHARPEE",
				"Mimikatz",
				"PowerExchange",
				"OilCheck",
				"RGDoor",
				"ftp"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6a60b1ba-609f-4bed-b15b-3ffc050d2ac6",
			"created_at": "2022-10-25T16:07:24.033083Z",
			"updated_at": "2026-04-10T02:00:04.846068Z",
			"deleted_at": null,
			"main_name": "Orangeworm",
			"aliases": [
				"G0071"
			],
			"source_name": "ETDA:Orangeworm",
			"tools": [
				"Kwampirs",
				"LOLBAS",
				"LOLBins",
				"Living off the Land"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "25896473-161f-411f-b76a-f11bb26c96bd",
			"created_at": "2023-01-06T13:46:38.75749Z",
			"updated_at": "2026-04-10T02:00:03.090307Z",
			"deleted_at": null,
			"main_name": "CHRYSENE",
			"aliases": [
				"Greenbug"
			],
			"source_name": "MISPGALAXY:CHRYSENE",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c786e025-c267-40bd-9491-328da70811a5",
			"created_at": "2025-08-07T02:03:24.736817Z",
			"updated_at": "2026-04-10T02:00:03.752071Z",
			"deleted_at": null,
			"main_name": "COBALT GYPSY",
			"aliases": [
				"APT34 ",
				"CHRYSENE ",
				"Crambus ",
				"EUROPIUM ",
				"Hazel Sandstorm ",
				"Helix Kitten ",
				"ITG13 ",
				"OilRig ",
				"Yellow Maero "
			],
			"source_name": "Secureworks:COBALT GYPSY",
			"tools": [
				"Glimpse",
				"Helminth",
				"Jason",
				"MacDownloader",
				"PoisonFrog",
				"RGDoor",
				"ThreeDollars",
				"TinyZbot",
				"Toxocara",
				"Trichuris",
				"TwoFace"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "67709937-2186-4a32-b64c-a5693d40ac77",
			"created_at": "2023-01-06T13:46:38.495593Z",
			"updated_at": "2026-04-10T02:00:02.999196Z",
			"deleted_at": null,
			"main_name": "OilRig",
			"aliases": [
				"Crambus",
				"Helix Kitten",
				"APT34",
				"IRN2",
				"ATK40",
				"G0049",
				"EUROPIUM",
				"TA452",
				"Twisted Kitten",
				"Cobalt Gypsy",
				"APT 34",
				"Evasive Serpens",
				"Hazel Sandstorm",
				"Earth Simnavaz"
			],
			"source_name": "MISPGALAXY:OilRig",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b6436f7b-6012-4969-aed1-d440e2e8b238",
			"created_at": "2022-10-25T16:07:23.91517Z",
			"updated_at": "2026-04-10T02:00:04.788408Z",
			"deleted_at": null,
			"main_name": "OilRig",
			"aliases": [
				"APT 34",
				"ATK 40",
				"Chrysene",
				"Cobalt Gypsy",
				"Crambus",
				"DEV-0861",
				"EUROPIUM",
				"Earth Simnavaz",
				"Evasive Serpens",
				"G0049",
				"Hazel Sandstorm",
				"Helix Kitten",
				"IRN2",
				"ITG13",
				"Scarred Manticore",
				"Storm-0861",
				"TA452",
				"Twisted Kitten",
				"UNC1860",
				"Yellow Maero"
			],
			"source_name": "ETDA:OilRig",
			"tools": [
				"AMATIAS",
				"Agent Drable",
				"Agent Injector",
				"AgentDrable",
				"Alma Communicator",
				"BONDUPDATER",
				"CACTUSPIPE",
				"Clayslide",
				"CypherRat",
				"DNSExfitrator",
				"DNSpionage",
				"DROPSHOT",
				"DistTrack",
				"DropperBackdoor",
				"Fox Panel",
				"GREYSTUFF",
				"GoogleDrive RAT",
				"HighShell",
				"HyperShell",
				"ISMAgent",
				"ISMDoor",
				"ISMInjector",
				"Jason",
				"Karkoff",
				"LIONTAIL",
				"LOLBAS",
				"LOLBins",
				"LONGWATCH",
				"LaZagne",
				"Living off the Land",
				"MailDropper",
				"Mimikatz",
				"MrPerfectInstaller",
				"OILYFACE",
				"OopsIE",
				"POWBAT",
				"POWRUNER",
				"Plink",
				"Poison Frog",
				"PowerExchange",
				"PsList",
				"PuTTY Link",
				"QUADAGENT",
				"RDAT",
				"RGDoor",
				"SEASHARPEE",
				"Saitama",
				"Saitama Backdoor",
				"Shamoon",
				"SideTwist",
				"SpyNote",
				"SpyNote RAT",
				"StoneDrill",
				"TONEDEAF",
				"TONEDEAF 2.0",
				"ThreeDollars",
				"TwoFace",
				"VALUEVAULT",
				"Webmask",
				"WinRAR",
				"ZEROCLEAR",
				"ZeroCleare",
				"certutil",
				"certutil.exe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434440,
	"ts_updated_at": 1775826781,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/1b261b26f52b3707f195ee9b041a4a837994d512.pdf",
		"text": "https://archive.orkl.eu/1b261b26f52b3707f195ee9b041a4a837994d512.txt",
		"img": "https://archive.orkl.eu/1b261b26f52b3707f195ee9b041a4a837994d512.jpg"
	}
}