BOOKWORM
- ID
- S1226
- Type
- Malware
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 22 Oct 2025
BOOKWORM is a modular trojan known to be leveraged by Mustang Panda and was first observed utilized in 2015. BOOKWORM was later updated in late 2021 and the fall of 2022 to launch shellcode represented as UUID parameters. [1][2][3]
Techniques used (17)
- T1001.003 Protocol or Service Impersonation
- T1027 Obfuscated Files or Information
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036.004 Masquerade Task or Service
- T1056.001 Keylogging
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1106 Native API
- T1112 Modify Registry
- T1115 Clipboard Data
- T1140 Deobfuscate/Decode Files or Information
- T1543.003 Windows Service
- T1553.002 Code Signing
- T1564.003 Hidden Window
- T1573.001 Symmetric Cryptography
- T1574.001 DLL