H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeGroup
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Orangeworm](https://attack.mitre.org/groups/G0071) is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018) Reverse engineering of [Kwampirs](https://attack.mitre.org/software/S0236), directly associated with [Orangeworm](https://attack.mitre.org/groups/G0071) activity, indicates significant functional and development overlaps with [Shamoon](https://attack.mitre.org/software/S0140).(Citation: Cylera Kwampirs 2022)

10 recorded

Relationships

uses
to Arp
Tool
uses
to cmd
Tool
usesTool
usesMalware
uses
to Net
Tool
usesTool
usesTool
usesTechnique
usesTool
usesTechnique
4 external

References

mitre-attack
G0071
open
Orangeworm
—
Cylera Kwampirs 2022
https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf
open
Symantec Orangeworm April 2018
https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia
open