HOMETHREATSOrchard
APT / THREAT GROUP

Orchard

3
aliases
Last seen:Mar 17, 2026

Intelligence Profile

A malware generating DGA domains seeded by the Bitcoin Genesis Block. This family has strong code overlap with win.victorygate.

Threat Analysis

Orchard is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://bin.re/blog/a-dga-seeded-by-the-bitcoin-genesis-block/
→https://blog.netlab.360.com/a-new-botnet-orchard-generates-dga-domains-with-bitcoin-transaction-information/
→https://blog.netlab.360.com/orchard-dga/
→https://malverse.it/stack-string-decryptor-con-ghidra-emulator-orchard

Quick Facts

TypeAPT / Threat Group
Aliases3

Also Known As

win.orchardOrchardAntavmu

External Intelligence

Malpedia: win.orchard

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Orchard