H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Orz

[Orz](https://attack.mitre.org/software/S0229) is a custom JavaScript backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065). It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Orz](https://attack.mitre.org/software/S0229) is a custom JavaScript backdoor used by [Leviathan](https://attack.mitre.org/groups/G0065). It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. (Citation: Proofpoint Leviathan Oct 2017) (Citation: FireEye Periscope March 2018)

Labels

malware
14 recorded

Relationships

uses
from Leviathan
Group
uses
to Bidirectional Communication
Technique
uses
to File and Directory Discovery
Technique
uses
to Indicator Removal
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Modify Registry
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Process Discovery
Technique
uses
to Process Hollowing
Technique
uses
to Regsvr32
Technique
uses
to Software Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Network Configuration Discovery
Technique
uses
to Windows Command Shell
Technique
5 external

References

mitre-attack
S0229
open
AIRBREAK
—
Orz
—
Proofpoint Leviathan Oct 2017
https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets
open
FireEye Periscope March 2018
https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance