aol.pm

BOOKWORM

Software · ATTACK:enterprise:S1226

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S1226",
  "title": "BOOKWORM",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1226",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--2ceddaf9-b16a-4f8b-b252-bcccccd3d79f",
  "external_id": "S1226",
  "domain": "enterprise",
  "created": "2025-07-21T19:02:10.637Z",
  "modified": "2025-10-21T16:51:50.819Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Broadcom",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"
    },
    {
      "source_name": "Unit42 Bookworm Nov2015",
      "url": "https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"
    },
    {
      "source_name": "Palo Alto Networks, Unit 42",
      "url": "https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09b8bc73-f318-4ff8-a7f1-2c1649df1186

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c349498-b79e-46f6-a1dd-12f9f61352a1

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3addbe51-c50a-4f35-8f9c-0ffe705ee5e1

Unit42 Bookworm Nov2015 · Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53d6538d-5b30-4503-94a3-077ddc428a3a

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a0c107f-aaf9-47f7-889e-8d374c5706a1

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74a577af-ef40-4767-a80a-68222fff5126

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bfbdba0-2f18-4697-bf86-294bda685df5

Unit42 Bookworm Nov2015 · Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d10b7f-e1eb-4ad0-821c-b35d177418f4

Broadcom · Unit42 Bookworm Nov2015 · Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--848da21a-d33d-4dc4-a948-4b0e30963d30

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cac77c8-0a5f-4950-8217-e280f3b16bd7

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9093e0ad-88a0-4575-8c31-3da712820947

Broadcom · Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92dc384d-3644-4b75-834d-d85c33aec69b

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5d639f5-6bda-4014-898b-ce2c96725402

Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0b79bdf-75ba-4133-bab0-2fe21f3ded43

Unit42 Bookworm Nov2015

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S1226

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6822e85-5683-498d-8731-a3638c05836d

Broadcom · Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7133f0c-0e76-4a10-8aa4-05a38fc1fbf7

Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e83c4950-2aef-4dfe-81bf-ccafc59ada7a

Palo Alto Networks, Unit 42

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f43a1b3a-432b-47e7-8da6-4bac45d1ae4e

Unit42 Bookworm Nov2015

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.