{
  "family": "occamy",
  "sample_count": 589,
  "category": "trojan_generic",
  "description": "Trojan:Win32/Occamy is a highly sophisticated, often fileless trojan framework engineered to evade detection and deliver severe secondary payloads like ransomware and information stealers.<br><br><b>Understanding Occamy</b><br>To an end-user, an Occamy infection presents no visible symptoms until the secondary payload executes. For threat intelligence analysts, Occamy represents a modern, evasive loader. It relies heavily on 'Living off the Land' (LotL) techniques, utilizing built-in Windows administrative tools (like PowerShell, WMI, and MSHTA) to download and execute its code entirely in memory, leaving a minimal footprint on the hard drive.<br><br><b>Execution and Evasion Strategies</b><br>Occamy is frequently distributed via weaponized Microsoft Office documents containing malicious VBA macros. Upon opening, the macro spawns a hidden PowerShell process that connects to a Command and Control (C2) server. It uses AES encryption and heavy obfuscation to hide its network traffic. The trojan employs Process Hollowing, injecting its malicious payload into legitimate system processes like <code>svchost.exe</code> or <code>explorer.exe</code> to bypass behavioral detection. Persistence is often achieved through WMI event subscriptions or hidden scheduled tasks rather than traditional Registry keys.<br><br><b>Indicators of Compromise & Impact</b><br>The impact of Occamy is a complete compromise of the endpoint, often leading to ransomware deployment or lateral movement. Incident responders should monitor for anomalous child processes spawning from Microsoft Office applications (e.g., <code>winword.exe</code> spawning <code>powershell.exe</code>). Hunt for encoded PowerShell commands (<code>-enc</code>) executing from the command line. Memory forensics is crucial to extract the decrypted Occamy payload from the hollowed system processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1055.012",
    "T1059.001",
    "T1027.005",
    "T1105",
    "T1546.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1546.003",
      "name": "Event Triggered Execution: Windows Management Instrumentation Event Subscription",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027.005",
      "name": "Obfuscated Files or Information: Indicator Removal from Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the C2 connection and prevent the download of secondary ransomware.",
    "Capture a full forensic memory dump; because Occamy often operates filelessly, crucial evidence exists only in RAM.",
    "Analyze PowerShell Script Block Logging (Event ID 4104) to decode the heavily obfuscated commands executed by the trojan.",
    "Rebuild the operating system entirely, as fileless persistence mechanisms (like WMI subscriptions) are notoriously difficult to fully eradicate."
  ],
  "what_to_avoid": [
    "Do not rely solely on traditional antivirus scans; fileless threats like Occamy are designed to bypass static, disk-based signatures.",
    "Avoid rebooting the machine during triage; rebooting clears the RAM and destroys the injected payloads needed for analysis."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}