Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 12:34:48 UTC
 Tool: AIRBREAK
Names
AIRBREAK
Orz
Category Malware
Type Backdoor, Reconnaissance, Info stealer, Exfiltration
Description
(Recorded Future) AIRBREAK, also known as Orz, is a JavaScript-based backdoor that
retrieves commands from hidden strings in compromised webpages and actor-controlled
profiles on legitimate services.
Information
MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 24 April 2021
Download this tool card in JSON format
All groups using tool AIRBREAK
Changed Name Country Observed
APT groups
 Leviathan, APT 40, TEMP.Periscope 2013-Jul 2021
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e3bf57b5-7c27-43ea-92f9-03656f8accb4
Page 1 of 2

↑
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e3bf57b5-7c27-43ea-92f9-03656f8accb4
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e3bf57b5-7c27-43ea-92f9-03656f8accb4
Page 2 of 2