LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0229: Orz

Orz is a custom JavaScript backdoor used by Leviathan. It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. [1] [2]

EnterpriseS0229MalwareObject v2.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Orz matters because it is a custom JavaScript backdoor for Windows associated in ATT&CK with Leviathan and historical spearphishing activity involving Microsoft Publisher files. For leaders, the defensive value is not just the malware name; it is the behavior pattern: script-based backdoor execution, host discovery, registry interaction, tool transfer, command-and-control over web services, and stealth techniques that can make a compromised workstation useful for longer-running espionage activity.

Executive priority

Prioritize validation around Windows endpoint visibility, email/file handling for uncommon document delivery paths, and incident response readiness for backdoor activity that performs discovery and uses legitimate-looking system utilities. Because ATT&CK provides no official detection guidance for Orz, executives should ask whether coverage is behavior-based across the mapped techniques rather than dependent on a malware signature or a dated campaign indicator.

Technical view

SOC and IR teams should treat Orz as a Windows malware object with relationships to discovery, execution, command-and-control, persistence/defense evasion, and stealth behaviors. Validate telemetry for command shell use, Regsvr32 execution, registry modification, process discovery, system/network/file/software discovery, process hollowing indicators, ingress file transfer, and bidirectional web-service communication. Detection engineering should map alerts to the related ATT&CK techniques rather than relying on the Orz name alone.

Likely telemetry

  • Windows process creation and command-line logging, especially cmd.exe and regsvr32.exe activity
  • Endpoint detection data for script execution, process injection or process hollowing patterns, and suspicious parent-child process relationships
  • Windows Registry modification events
  • File creation, file download, and tool transfer evidence on endpoints
  • DNS, proxy, firewall, and web traffic logs for external bidirectional communication patterns

Detection direction

  • Build or validate behavior detections for the related techniques: T1059.003, T1218.010, T1112, T1055.012, T1102.002, T1105, T1016, T1057, T1082, T1083, T1518, T1027, and T1070.
  • Tune for legitimate administrative use of cmd.exe, regsvr32.exe, registry tools, and discovery commands; the detection value is in unusual context, sequencing, parent process, destination, and user/system baseline deviation.
  • Do not assume Orz-specific signatures are sufficient. ATT&CK does not provide official detection text for this object, so local validation should focus on whether the environment can observe the mapped behaviors.
  • Check for blind spots around script content visibility, obfuscated files, signed Windows utility abuse, endpoint memory telemetry for hollowing, and network channels that blend into ordinary web traffic.

Mitigation priorities

  • Start with visibility: ensure Windows endpoint, command-line, registry, file, email attachment, and network web/proxy telemetry are retained and searchable for investigations.
  • Reduce execution risk from script and document-borne payloads through controlled handling of high-risk attachment types and enforcement of least privilege on workstations.
  • Harden and monitor legitimate Windows utilities that can proxy execution, including Regsvr32 and command shell use, without assuming they can be fully blocked in all environments.
  • Apply least privilege and change-control discipline around registry locations used for persistence or defense evasion.
  • Prepare IR playbooks for backdoor cases that include scoping discovery activity, reviewing inbound tool transfers, and reconstructing command-and-control communications.
Additional notes and limits

The most decision-relevant context is that Orz is a custom JavaScript backdoor used by Leviathan, observed historically in 2014 and in August 2017 when dropped by Microsoft Publisher files. ATT&CK relationships show a broad behavior set that should be used to guide control validation and detection coverage testing.

The supplied ATT&CK object does not include official detection guidance, aliases, labels, or object-level tactics. The relationship techniques provide behavioral direction, but environment-specific evidence is required to determine exposure, alert quality, and incident significance. No active exploitation or current campaign activity should be inferred from these fields alone.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Orz

Orz is a custom JavaScript backdoor used by Leviathan. It was observed being used in 2014 as well as in August 2017 when it was dropped by Microsoft Publisher files. [1] [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

13 rows
DomainIDNameRelationship / procedure
EnterpriseT1083File and Directory Discovery

Orz can gather victim drive information.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Orz can execute shell commands.[1] Orz can execute commands with JavaScript.[1]

EnterpriseT1218.010Regsvr32Sub-technique

Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.[1]

EnterpriseT1102.002Bidirectional CommunicationSub-technique

Orz has used Technet and Pastebin web pages for command and control.[1]

EnterpriseT1057Process Discovery

Orz can gather a process list from the victim.[1]

EnterpriseT1082System Information Discovery

Orz can gather the victim OS version and whether it is 64 or 32 bit.[1]

EnterpriseT1070Indicator Removal

Orz can overwrite Registry settings to reduce its visibility on the victim.[1]

EnterpriseT1518Software Discovery

Orz can gather the victim's Internet Explorer version.[1]

EnterpriseT1105Ingress Tool Transfer

Orz can download files onto the victim.[1]

EnterpriseT1112Modify Registry

Orz can perform Registry operations.[1]

EnterpriseT1016System Network Configuration Discovery

Orz can gather victim proxy information.[1]

EnterpriseT1055.012Process HollowingSub-technique

Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.[1]

EnterpriseT1027Obfuscated Files or Information

Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0065: Leviathan

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.[1] Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Australia, Europe, the Middle East, and Southeast Asia.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1102.002: Bidirectional CommunicationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1518: Software DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · GroupG0065: LeviathanEnterpriseuses · TechniqueT1055.012: Process HollowingEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.2
Created
Modified
Raw hash
7e28c3fc159dc01e...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.2Current bundle7e28c3fc159d…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  2. [2]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  3. [3]
    CISA AA21-200A APT40 July 2021

    CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.

    Open source URL
  4. [4]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  5. [5]
    AIRBREAK

    (Citation: FireEye Periscope March 2018)

  6. [6]
    AIRBREAK

    (Citation: FireEye Periscope March 2018)

  7. [7]
    AIRBREAK

    (Citation: FireEye Periscope March 2018)

  8. [8]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  9. [9]
    FireEye Periscope March 2018

    FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.

    Open source URL
  10. [10]
    Orz

    (Citation: Proofpoint Leviathan Oct 2017)

  11. [11]
    Orz

    (Citation: Proofpoint Leviathan Oct 2017)

  12. [12]
    Orz

    (Citation: Proofpoint Leviathan Oct 2017)

  13. [13]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  14. [14]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  15. [15]
    mitre-attackS0229
    Open source URL
  16. [16]
    mitre-attackS0229
    Open source URL
  17. [17]
    mitre-attackS0229
    Open source URL
  18. [18]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  19. [19]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  20. [20]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  21. [21]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  22. [22]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  23. [23]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  24. [24]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  25. [25]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  26. [26]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  27. [27]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  28. [28]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  29. [29]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  30. [30]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  31. [31]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  32. [32]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  33. [33]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  34. [34]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  35. [35]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  36. [36]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  37. [37]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  38. [38]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  39. [39]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  40. [40]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  41. [41]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  42. [42]
    Accenture MUDCARP March 2019

    Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.

    Open source URL
  43. [43]
    CISA AA21-200A APT40 July 2021

    CISA. (2021, July 19). (AA21-200A) Joint Cybersecurity Advisory – Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department. Retrieved August 12, 2021.

    Open source URL
  44. [44]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  45. [45]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  46. [46]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
  47. [47]
    Proofpoint Leviathan Oct 2017

    Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use