Orz
AIRBREAK, also referred to as Orz, is a first-stage backdoor associated with the China-linked espionage actor APT40, also tracked as Leviathan, MUDCARP, and temp.Periscope. Reporting in the provided content describes it as a custom-built JavaScript backdoor used before downloading additional payloads. APT40 has used AIRBREAK/Orz alongside other tooling such as Cobalt Strike, China Chopper, Derusbi, GreenCrash, HOMEFRY, and MURKYTOP.
Observed capabilities in the content include command execution via shell commands and JavaScript, Registry operations, overwriting Registry settings to reduce visibility on the victim, gathering the victim’s Internet Explorer version, collecting victim proxy information, and obtaining a process list. AIRBREAK/Orz has used Technet and Pastebin web pages for command and control. Some versions contain an embedded DLL named MockDll that uses process hollowing and regsvr32 to execute another payload.
The content also describes a Windows executable that spoofed a decryption tool and dropped the Orz JavaScript backdoor, which was then executed with Wscript. Related tradecraft associated with the same activity included persistence via the Windows Run key at HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and abuse of zipfldr.dll through the RouteTheCall export to launch a malicious process or command. High-confidence indicators explicitly mentioned in the content for this activity include the domains chemscalere[.]com, candlelightparty[.]org, www.candlelightparty[.]org, and newapp.freshasianews[.]com, as well as the hashes cd195ee448a3657b5c2c2d13e9c7a2e2, b43ad826fe6928245d3c02b648296b43, 889a9b52566448231f112a5ce9b5dfaf, b8ec65dab97cdef3cd256cc4753f0c54, and 04d83cd3813698de28cfbba326d7647c. APT40 targeting described in the content includes government, academic, maritime, defense, engineering, transportation, and Belt and Road-related sectors.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tools Nanhaishu, Orz, SeDll, Cobalt Strike, GreenCrash, AIRBREAK, BlackCoffee, China Chopper, FUSIONBLAZE, HOMEFRY, MURKYTOP, Metasploit / Meterpreter, ScanBox, Derusbi Trojan, Derusbi, Metasploit
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques"APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation..."
"The operation’s spear-phishing emails typically leverage malicious attachments..."
Execution
3 techniquesDuring the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions.
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. Orz can execute commands with JavaScript. Patchwork used JavaScript code and .SCT files on victim machines. Water Curupira Pikabot Distribution installation via JavaScript will launch follow-on commands via cmd.exe.
Persistence
2 techniquesNeoichor can clear the browser history on a compromised host by changing the ClearBrowsingHistoryOnExit value to 1 in the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy Registry key.
After a successful reboot, the malware is made persistent by a manipulating [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'help'='c:\windows\system32\rundll32.exe c:\windows\system32\zipfldr.dll,RouteTheCall c:\programdata\winapp.exe' .
Privilege Escalation
2 techniques"Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code." / "Astaroth can create a new process in a suspended state... unmap its memory and replace it with malicious code." / "Emotet uses a copy of certutil.exe stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code."
After a successful reboot, the malware is made persistent by a manipulating [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]'help'='c:\windows\system32\rundll32.exe c:\windows\system32\zipfldr.dll,RouteTheCall c:\programdata\winapp.exe' .
Stealth
6 techniquesThe content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
"Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code." / "Astaroth can create a new process in a suspended state... unmap its memory and replace it with malicious code." / "Emotet uses a copy of certutil.exe stored in a temporary directory for process hollowing, starting the program in a suspended state before loading malicious code."
APT42 has cleared Chrome browser history. ... APT5 has used the THINBLOOD utility to clear SSL VPN log files ... Bankshot deletes all artifacts ... DarkWatchman ... clear the browser history ... CSPY Downloader ... remove values it writes to the Registry ... Mustang Panda has deleted registry keys ...
AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. ... Raspberry Robin uses regsvr32.exe execution without any command line parameters for command and control requests to IP addresses associated with Tor nodes.
HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.
Defense Impairment
2 techniquesNeoichor can clear the browser history on a compromised host by changing the ClearBrowsingHistoryOnExit value to 1 in the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy Registry key.
BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.
Credential Access
1 technique"...credential harvesting tools to escalate privileges and dump password hashes... ProcDump... Windows Credential Editor (WCE)..."
Discovery
6 techniquesThe content repeatedly describes actors and malware using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, netsh interface show, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, and network adapter/interface details.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
“3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory… admin@338 actors used… dir c:\ >> %temp%\download … APT28 has used Forfiles to locate PDF, Excel, and Word documents…”
"Bundlore has the ability to enumerate what browser is being used as well as version information"; "Orz can gather the victim's Internet Explorer version"; "SUGARDUMP can identify ... browsers, including version number"; "SideCopy has collected browser information"
"Bazar can query the Registry for installed applications." / "BRONZE BUTLER has used tools to enumerate software installed on an infected host." / "LightSpy ... enumerate the Applications folder to collect the bundle name, bundle identifier, and version information..." / "Volt Typhoon has queried the Registry on compromised systems for information on installed software."
Command and Control
3 techniques"Common TCP ports 80 and 443 are used to blend in with routine network traffic."
The adversaries had communicated to both Dropbox and Pastebin. APT28 has used Google Drive for C2. APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.
"APT39 has communicated with C2 through files uploaded to and downloaded from DropBox."; "RIFLESPINE can retrieve C2 commands from an encrypted file on Google Drive then upload the results ... back to Google Drive."; "CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data"
Recent activity
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware with an embedded DLL, MockDll, that uses Process Hollowing and regsvr32 to execute another payload.
A custom-built JavaScript backdoor associated with MUDCARP that is dropped by a Windows executable and executed using Wscript, with persistence established via rundll32 and zipfldr.dll RouteTheCall after reboot.
Backdoor that uses public web pages (TechNet, Pastebin) for command-and-control.
Malware that uses TechNet and Pastebin web pages for command and control.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.