LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1226: BOOKWORM

BOOKWORM is a modular trojan known to be leveraged by Mustang Panda and was first observed utilized in 2015. BOOKWORM was later updated in late 2021 and the fall of 2022 to launch shellcode represented as UUID parameters. [1][2][3]

EnterpriseS1226MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

BOOKWORM matters because it is a Windows modular trojan associated in ATT&CK with Mustang Panda and a broad set of behaviors spanning stealth, persistence, collection, credential access, execution, and command-and-control. For leaders, the decision value is not a single malware name; it is whether Windows endpoint monitoring, service and registry governance, and web-traffic visibility can withstand malware that blends into normal system and network activity.

Executive priority

Prioritize BOOKWORM as a coverage-validation case for Windows endpoint resilience and espionage-oriented incident readiness. The ATT&CK relationships point to controls that often determine response quality: visibility into services and registry changes, DLL activity, code-signing trust decisions, clipboard/keylogging risk, timestamp manipulation, and encrypted or impersonated web C2. Executives should ask whether the organization can prove these behaviors are logged, retained, and reviewed—not merely whether a malware signature exists.

Technical view

ATT&CK lists BOOKWORM as Windows malware with no official detection text. Detection engineering should therefore focus on the related behaviors: Windows service creation/modification, registry modification, DLL abuse, hidden windows, native API execution, timestomping, obfuscated or encoded files, deobfuscation activity, code-signing anomalies, user discovery, keylogging, clipboard collection, and C2 over web protocols with protocol impersonation or symmetric encryption. The description also notes later updates launching shellcode represented as UUID parameters, so analysts should consider abnormal UUID-like parameter use in suspicious execution chains where local telemetry supports that analysis.

Likely telemetry

  • Windows EDR process, module-load, command-line, and parent-child process telemetry
  • Windows service creation, service modification, and service configuration history
  • Windows Registry modification events, especially persistence- and service-related keys
  • File creation/modification metadata, including timestamp anomalies and MFT-style forensic evidence where available
  • DLL load events and executable-to-DLL path relationships

Detection direction

  • Because ATT&CK provides no official detection guidance, validate behavior-based analytics rather than relying on the BOOKWORM name alone.
  • Correlate service and registry changes with new executable paths, suspicious parent processes, unsigned or unusual signed binaries, and abnormal persistence timing.
  • Tune DLL-abuse detections around uncommon DLL load paths, unexpected module relationships, and newly introduced DLLs near legitimate applications; account for administrative software that legitimately loads plugins or helper DLLs.
  • Review file timestamp anomaly coverage, but treat timestomp detections as forensic leads because backup, deployment, and migration tools can also alter timestamps.
  • Monitor web-protocol C2 patterns for unusual destinations, user agents, session shapes, or protocol mismatches; encrypted or impersonated traffic may limit content inspection, making metadata and endpoint context important.

Mitigation priorities

  • Confirm Windows endpoint protection, logging, and retention cover the related behaviors before investing in malware-specific detection only.
  • Restrict and audit administrative permissions that can create services, modify service configuration, alter sensitive registry areas, or install trusted binaries.
  • Harden application execution paths, DLL search/load behavior, and software allowlisting where feasible to reduce abuse of legitimate-looking components.
  • Strengthen code-signing validation processes, including review of unusual signers and signed binaries appearing in abnormal locations or execution chains.
  • Apply egress controls and proxy monitoring for web-protocol communications, with emphasis on destinations and patterns that do not match business use.
Additional notes and limits

This take is based on ATT&CK S1226 BOOKWORM, its official description, external references, and supplied relationships. The richest defensive value comes from the mapped techniques rather than from object-level detection guidance, which is absent. Local baselining is required because many related behaviors—web traffic, services, registry changes, signed binaries, DLL loading, and administrative hidden-window activity—can also be legitimate.

ATT&CK lists the malware platform as Windows but does not specify object-level tactics or official detections. The supplied data supports association with Mustang Panda and listed techniques, but it does not prove current activity, local exposure, specific indicators, exploit methods, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BOOKWORM

BOOKWORM is a modular trojan known to be leveraged by Mustang Panda and was first observed utilized in 2015. BOOKWORM was later updated in late 2021 and the fall of 2022 to launch shellcode represented as UUID parameters. [1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

17 rows
DomainIDNameRelationship / procedure
EnterpriseT1033System Owner/User Discovery

BOOKWORM has obtained the username from an infected host. [2]

EnterpriseT1553.002Code SigningSub-technique

BOOKWORM has used valid legitimate digital signatures and certificates to evade detection. [2]

EnterpriseT1071.001Web ProtocolsSub-technique

BOOKWORM has communicated with its C2 via HTTP POST requests. [2][3]

EnterpriseT1112Modify Registry

BOOKWORM has modified Registry key values as part of its created service `DeviceSync`. [2]

EnterpriseT1543.003Windows ServiceSub-technique

BOOKWORM has created a service named `Microsoft Windows DeviceSync Service` at `HKLM\SYSTEM\CurrentControlSet\Services\DeviceSync\` to trigger execution when the system starts and to maintain persistence. [2]

EnterpriseT1564.003Hidden WindowSub-technique

BOOKWORM has created a hidden window when conducting key logging and clipboard theft through its KBLogger.dll module.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

BOOKWORM has decoded its Base64 encoded payload prior to execution.[3] BOOKWORM has also encrypted files with RC4 and has decrypted its payload prior to execution.[2]

EnterpriseT1574.001DLLSub-technique

BOOKWORM has used DLL side-loading to execute the malicious payload. [1][3] BOOKWORM has also side-loaded DLL components into a legitimate process, including Microsoft Malware Protection `MsMpEng.exe` and Kaspersky Anti-Virus `ushata.exe`.[2]

EnterpriseT1036.004Masquerade Task or ServiceSub-technique

BOOKWORM has created services that attempt to resemble legitimate services to include a service named `Microsoft Windows DeviceSync Service`.[2]

EnterpriseT1056.001KeyloggingSub-technique

BOOKWORM has used its KBLogger.dll module to capture keystrokes and stored them in a folder. [2]

EnterpriseT1106Native API

BOOKWORM has used various Windows API calls during execution and defense evasion.[1] [3] BOOKWORM has created a buffer on the heap using `HeapCreate` and `HeapAlloc` which allows for copying of shell code and then execution on the heap is initiated through callback function of legitimate API functions such as `EnumChildWindows` or `EnumSystemLanguageGroupsA`. [3]

EnterpriseT1573.001Symmetric CryptographySub-technique

BOOKWORM has used encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO. [2]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

BOOKWORM has utilized Base64 encoding to obfuscate its payload.[3]

EnterpriseT1027Obfuscated Files or Information

BOOKWORM has been delivered using self-extracting RAR archives.[2]

EnterpriseT1070.006TimestompSub-technique

BOOKWORM has modified file timestamps from the export address table (EAT) to make it difficult to discern when the module was created. [3]

EnterpriseT1001.003Protocol or Service ImpersonationSub-technique

BOOKWORM has modified HTTP POST requests to resemble legitimate communications.[3]

EnterpriseT1115Clipboard Data

BOOKWORM has used its KBLogger.dll module to steal data saved to the clipboard. [2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0129: Mustang Panda

Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailored phishing lures and decoy documents to deliver malicious payloads. Mustang Panda has targeted government, diplomatic, and non-governmental organizations, including think tanks, religious institutions, and research entities, across the United States, Europe, and Asia, with notable activity in Russia, Mongolia, Myanmar, Pakistan, and Vietnam. [1][2][3][4][5][6][7][8][9][10][11][12][13]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1553.002: Code SigningEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1036.004: Masquerade Task or ServiceEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · GroupG0129: Mustang PandaEnterpriseuses · TechniqueT1070.006: TimestompEnterpriseuses · TechniqueT1001.003: Protocol or Service ImpersonationEnterpriseuses · TechniqueT1115: Clipboard DataEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
cff78ce71b4b7151...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlecff78ce71b4b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  2. [2]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  3. [3]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  4. [4]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  5. [5]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  6. [6]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  7. [7]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  8. [8]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  9. [9]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  10. [10]
    mitre-attackS1226
    Open source URL
  11. [11]
    mitre-attackS1226
    Open source URL
  12. [12]
    mitre-attackS1226
    Open source URL
  13. [13]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  14. [14]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  15. [15]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  16. [16]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  17. [17]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  18. [18]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  19. [19]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  20. [20]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  21. [21]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  22. [22]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  23. [23]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  24. [24]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  25. [25]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  26. [26]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  27. [27]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  28. [28]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  29. [29]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  30. [30]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  31. [31]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  32. [32]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  33. [33]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  34. [34]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  35. [35]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  36. [36]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  37. [37]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  38. [38]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  39. [39]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  40. [40]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  41. [41]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  42. [42]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  43. [43]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  44. [44]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  45. [45]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  46. [46]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  47. [47]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  48. [48]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  49. [49]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  50. [50]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
  51. [51]
    Broadcom

    Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.

    Open source URL
  52. [52]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  53. [53]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  54. [54]
    Palo Alto Networks, Unit 42

    Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.

    Open source URL
  55. [55]
    Unit42 Bookworm Nov2015

    Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use