ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

Bookworm

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.

Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.

Palo Alto Unit 42 · 29d agoThreat actor in the wild

Appears with

threat actor Lazarus 1threat actor Mustang Panda 1threat actor Stately Taurus 1malware PubLoad 1malware ToneShell 1organization CSIRT CTI 1organization Lab52 1organization NCC Group 1organization Palo Alto Networks 1organization Unit 42 1product Bookworm 1product PubLoad 1product ToneShell 1vendor Microsoft 1victim ASEAN-affiliated organizations 1victim Myanmar government 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.