Orangeworm APT And Kwampirs Backdoor

An advanced persistent threat (APT) group has been observed targeting large healthcare organisations throughout Europe, the USA and Asia. Known as Orangeworm, the group use a custom backdoor called Kwampirs.

According to Symantec telemetry, almost 40 percent of Orangeworm’s confirmed victim organizations operate within the healthcare industry.

The group perform extensive research to identify suitable targets; although it is unclear at the time of publication how they compromise devices, with reports indicating spear-phishing emails have been used. Once on a device, Kwampirs will aggressively propagate through the network using SMB. It will copy itself to all network shares and file servers where it will then infect any user who connects to them.

Orangeworm will then target a subset of the infected devices for further scrutiny, exfiltrating any data they deem usable. The motive behind the attacks appears to be the collection of patient data; with infections observed on medical devices such as X-ray machines, GP booking systems and prescription services.

Once Orangeworm has infiltrated a victim’s network, they deploy Trojan.Kwampirs, a backdoor Trojan that provides the attackers with remote access to the compromised computer.

C&C Servers

65.116.107.24

13.44.61.126

56.28.111.63

118.71.138.69

117.32.65.101

18.25.62.70

92.137.43.17

33.25.72.21

16.48.37.37

91.29.51.11

Affected Platforms

Microsoft Windows – All versions

Medical Devices