Orangeworm
Orangeworm is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 8 sectors, including Technology and Manufacturing, in 23 countries, including the United States and the United Kingdom. It uses 23 MITRE ATT&CK techniques.
- G0071
- Techniques
- 23
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2015
- Last seen
- Apr 23, 2018
- Record updated
Who They Target.
About Orangeworm.
Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage. Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.