SYMBOLCOMMON_NAMEaka. SYNONYMS

Orangeworm  (Back to overview)


Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, Europe, and Asia. First identified in January 2015, Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims. Known victims include healthcare providers, pharmaceuticals, IT solution providers for healthcare and equipment manufacturers that serve the healthcare industry, likely for the purpose of corporate espionage.

Associated Families
win.kwampirs
References
2022-03-14 ⋅ The Hacker News ⋅ Ravie Lakshmanan
Researchers Find New Evidence Linking Kwampirs Malware to Shamoon APT Hackers
Kwampirs
2022-03-08 ⋅ Cylera ⋅ Cylera
The link between Kwampirs (Orangeworm) and Shamoon APTs
DistTrack Kwampirs
2022-02-15 ⋅ Cylera ⋅ Pablo Rincón Crespo
New Evidence Linking Kwampirs Malware to Shamoon APTS (Technical Blog)
Kwampirs
2021-03-21 ⋅ Blackberry ⋅ Blackberry Research
2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot
2020-07-29 ⋅ Atlantic Council ⋅ June Lee, Stewart Scott, Trey Herr, William Loomis
BREAKING TRUST: Shades of Crisis Across an Insecure Software Supply Chain
EternalPetya GoldenSpy Kwampirs Stuxnet
2020-03-31 ⋅ ZDNet ⋅ Catalin Cimpanu
FBI re-sends alert about supply chain attacks for the third time in three months
Kwampirs
2020-03-25 ⋅ Reversing Labs ⋅ Karlo Zanki
Unpacking the Kwampirs RAT
Kwampirs
2020-03-25 ⋅ FBI ⋅ FBI
FBI Flash CP-000111-MW: Kwampirs Malware Indicators of Compromise Employed in Ongoing Cyber Supply Chain Campaign Targeting Global Industries
Kwampirs
2020-02-10 ⋅ ZDNet ⋅ Catalin Cimpanu
FBI warns about ongoing attacks against software supply chain companies
DistTrack Kwampirs
2019-03-13 ⋅ Security Art Work ⋅ Lab52
ORANGEWORM GROUP – KWAMPIRS ANALYSIS UPDATE
Kwampirs
2019-01-01 ⋅ MITRE ⋅ MITRE ATT&CK
Group description: Orangeworm
Orangeworm
2018-04-23 ⋅ Symantec ⋅ Security Response Attack Investigation Team
New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia
Kwampirs Orangeworm
Credits: MISP Project