H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[BOOKWORM](https://attack.mitre.org/software/S1226) is a modular trojan known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129) and was first observed utilized in 2015. [BOOKWORM](https://attack.mitre.org/software/S1226) was later updated in late 2021 and the fall of 2022 to launch shellcode represented as UUID parameters. (Citation: Broadcom)(Citation: Unit42 Bookworm Nov2015)(Citation: Palo Alto Networks, Unit 42)

Labels

malware

18 recorded

Relationships

uses

to Clipboard Data

Technique

uses

to Code Signing

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Hidden Window

Technique

uses

to Keylogging

Technique

uses

to Masquerade Task or Service

Technique

uses

to Modify Registry

Technique

uses

to Native API

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Protocol or Service Impersonation

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Owner/User Discovery

Technique

uses

to Timestomp

Technique

uses

to Web Protocols

Technique

uses

to Windows Service

Technique

uses

from Mustang Panda

Group

4 external

References

mitre-attack

S1226

open

Broadcom

https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia

open

Unit42 Bookworm Nov2015

https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/

open

Palo Alto Networks, Unit 42

https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/

open