The group is widely believed to have a background in South Asia, with its earliest attacks dating back to November 2009 and has been active for more than 10 years. The group mainly targets countries in the Asian region to carry out cyber espionage activities, and the targets include organizations in the government, military, electric power, industry, scientific research and education, diplomacy and economic fields. Brain worm, aka Donot, Qianxin internal tracking number APT-Q-38. The organization mainly targets countries in South Asia such as Pakistan, Bangladesh, and Sri Lanka, and carries out cyber espionage activities and steals sensitive information from government agencies, defense and military, foreign affairs departments, and important people in the business field. The Brain Worm group has both Windows and Android attack capabilities, and has often spread malicious code through spear emails and Android APKs carrying Office vulnerabilities or malicious macro documents in previous attack campaigns.