New Orangeworm attack group targets healthcare sector in US, Europe and Asia likely for corporate espionage

Posted on Apr 27 2018 - 11:06am by Contributing Writer

By Symantec Security Response

Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, Europe, and Asia.

First identified in January 2015, Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims. Known victims include healthcare providers, pharmaceuticals, IT solution providers for healthcare and equipment manufactures that serve the healthcare industry likely for the purpose of corporate espionage.

Sights set on healthcare

Based on the list of known victims, Orangeworm does not select its targets randomly or conduct opportunistic hacking. Rather, the group appears to choose its targets carefully and deliberately, conducting a good amount of planning before launching an attack.

According to Symantec telemetry, almost 40 percent of Orangeworm’s confirmed victim organizations operate within the healthcare industry. The Kwampirs malware was found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines. Additionally, Orangeworm was observed to have an interest in machines used to assist patients in completing consent forms for required procedures. The exact motives of the group are unclear.

The biggest number of Orangeworm’s victims are located in the US, accounting for 17 percent of the infection rate by region. While Orangeworm has impacted only a small set of victims in 2016 and 2017 according to Symantec telemetry, we have seen infections in multiple countries due to the nature of the victims operating large international corporations.

Healthcare providers caught in the crosshairs

We believe that these industries have also been targeted as part of a larger supply-chain attack in order for Orangeworm to get access to their intended victims related to healthcare. Orangeworm’s secondary targets include Manufacturing, Information Technology, Agriculture and Logistics. While these industries may appear to be unrelated, we found them to have multiple links to healthcare, such as large manufacturers that produce medical imaging devices sold directly into healthcare firms, IT organizations that provide support services to medical clinics, and logistical organizations that deliver healthcare products.

Post-compromise activities

Once Orangeworm has infiltrated a victim’s network, they deploy Trojan.Kwampirs, a backdoor Trojan that provides the attackers with remote access to the compromised computer.

When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

The backdoor also collects some rudimentary information about the compromised computer including some basic network adapter information, system version information, and language settings.

Orangeworm likely uses this information to determine whether the system is used by a researcher or if the victim is a high-value target. Once Orangeworm determines that a potential victim is of interest, it proceeds to aggressively copy the backdoor across open network shares to infect other computers.

It may copy itself to the following hidden file shares:

  • ADMIN$

Information gathering

At this point, the attackers proceed to gather additional information about the victim’s network as possible, including any information pertaining to recently accessed computers, network adapter information, available network shares, mapped drives and files present on the compromised computer.

We have observed the attackers executing the following commands within victim environments:

Command Description
cmd.exe /c “arp -a” 2>nul Display recently contacted addresses per available network interface
cmd.exe /c “systeminfo” 2>nul Display detailed configuration information for the system and its operating system (e.g. OS version information, registered owner details, manufacture details, processor type, available storage, list of installed patches, etc.)
cmd.exe /c “hostname” 2>nul Display system’s configured hostname
cmd.exe /c “ver” 2>nul Display system version information
cmd.exe /c “route print” 2>nul Display routing table for available network interfaces
cmd.exe /c “getmac” 2>nul Display the systems configured MAC address
cmd.exe /c “ipconfig /all” 2>nul Display IP address configuration information for any available network interfaces
cmd.exe /c “netstat -nao” 2>nul Display a list of active and listening connections (TCP and UDP)
cmd.exe /c “tasklist /v” 2>nul Display list of running system processes
cmd.exe /c “tasklist /svc” 2>nul Display list of running system services
cmd.exe /c “net share” 2>nul Display list of available network shares
cmd.exe /c “net users” 2>nul Display list of available user groups
cmd.exe /c “set” 2>nul Display list of configured environment variables
cmd.exe /c “net accounts” 2>nul Display account policy information (e.g. maximum password age, length of password, lockout duration, etc.)
cmd.exe /c “net config workstation” 2>nul Display system network configuration information (e.g. computer name, current username, version information, domain configuration, etc.)
cmd.exe /c “net localgroup administrators” 2>nul Display list of local accounts with administrative access
cmd.exe /c “net localgroup users” 2>nul Display list of local accounts that are part of the current domain
cmd.exe /c “net localgroup /domain” 2>nul Display domain local groups
cmd.exe /c “net use” 2>nul Display list of available network mappings
cmd.exe /c “net view” 2>nul Display list of available servers on the network
cmd.exe /U /c dir /s /a c:\ >> “C:\windows\TEMP\[RANDOM].tmp” 2>nul List files and directories in C:\
cmd.exe /c “cmd /c date /t” 2>nul Display system date
cmd.exe /c “net localgroup “domain admins” /domain” 2>nul Display list of domain administrator accounts and local administrator accounts
cmd.exe /c “cmd /c time /t” 2>nul Display system time

No concern about being discovered

Kwampirs uses a fairly aggressive means to propagate itself once inside a victim’s network by copying itself over network shares. While this method is considered somewhat old, it may still be viable for environments that run older operating systems such as Windows XP. This method has likely proved effective within the healthcare industry, which may run legacy systems on older platforms designed for the medical community. Older systems like Windows XP are much more likely to be prevalent within this industry.

Additionally, once infected, the malware cycles through a large list of command and control (C&C) servers embedded within the malware. It appears while the list is extensive, not all of the C&Cs are active and continue to beacon until a successful connection is established. Despite modifying a small part of itself while copying itself across the network as a means to evade detection, the operators have made no effort to change the C&C communication protocol since its first inception.

Both of these methods are considered particularly “noisy” and may indicate that Orangeworm is not overly concerned with being discovered. The fact that little has changed with the internals of Kwampirs since its first discovery may also indicate that previous mitigation methods against the malware have been unsuccessful, and that the attackers have been able to reach their intended targets despite defenders being aware of their presence within their network.

No hallmarks of a nation-state actor

While Orangeworm is known to have been active for at least several years, we do not believe that the group bears any hallmarks of a state-sponsored actor—it is likely the work of an individual or a small group of individuals. There are currently no technical or operational indicators to ascertain the origin of the group.

Symantec customers are protected against Orangeworm and Symantec has also made efforts to notify identified targets of its operations.

Customers with Intelligence Services or WebFilter-enabled products are protected against activity associated with the Orangeworm group. These products include:

  • Web Security Service (WSS)
  • ProxySG
  • Advanced Secure Gateway (ASG)
  • Security Analytics
  • Content Analysis
  • Malware Analysis
  • SSL Visibility
  • PacketShaper

Symantec has the following specific detections in place for tools used by Orangeworm:

Anti-virus (AV):

Intrusion prevention system (IPS):

Indicators of Compromise

Sample hashes

SHA256 Hash Filename
3e7181fd3e893e6b13cc40ed70afa549c8aaf37fe9bee22445b8bd912d7bc522 wmiapsvre.exe
1459a915a338e4da0f89f5d8877e2c685e6d53eb54a7c6e214c243074615d57a wmiapsrvux.exe
3e7181fd3e893e6b13cc40ed70afa549c8aaf37fe9bee22445b8bd912d7bc522 wmiapvsre.exe
f8022b973900c783fd861ede7d0ac02f665c041b9cd0641be7318999fb82ce8f wmipsvrce.exe
3e7181fd3e893e6b13cc40ed70afa549c8aaf37fe9bee22445b8bd912d7bc522 wmiapsvrce.exe
f8022b973900c783fd861ede7d0ac02f665c041b9cd0641be7318999fb82ce8f wmiapsrvce.exe
40eb27bb3689dd0420ce688ee235fe604afa7a19edf53caf497dbe4f2e3b5f61 WMIPRVSE.EXE
1459a915a338e4da0f89f5d8877e2c685e6d53eb54a7c6e214c243074615d57a wmiprvse.exe
1459a915a338e4da0f89f5d8877e2c685e6d53eb54a7c6e214c243074615d57a wmipvsre.exe
40eb27bb3689dd0420ce688ee235fe604afa7a19edf53caf497dbe4f2e3b5f61 wmipsvrce.exe

Sample C&Cs



Related Posts

Kaspersky Lab identifies targeted attack utilizing... Kaspersky Lab, a leading developer of secure content and threat management solutions, has announced that it detected a new targeted attack against Uyg...
Bad password habits ‘like leaving the front ... Internet users across the globe are yet to master how to use passwords effectively to protect themselves online. Research from Kaspersky Lab has shown...
Companies actively using cloud, big data realize h... Organizations actively using cloud, mobility, big data or security technologies are experiencing up to 53 percent higher revenue growth rates than tho...
Security expert warns of mass attacks on online ba... Kaspersky Lab has recorded several thousand attempts to infect computers used for online banking with a malicious program that its creators claim can ...
Huawei unveils TE10 6-in-1 huddle-room cloud video... Huawei released the world's first "6-in-1" huddle-room cloud video endpoint in the shape of the TE10. The TE10 is a cloud-based product that supports ...
Concern for online security of older relatives not... It’s well documented that younger generations are spending a greater proportion of their lives online, but they’re not the only ones. Older users (age...
Crossing the online privacy border puts Valentine’... When relationships blossom, individual digital lives become blurred and online boundaries compromised, which can endanger our personal privacy. Accord...
Relationship break-ups put personal privacy at ris... With online accounts and connected devices playing an ever-growing role in our daily lives, it has become harder than ever for people in relationships...
Kaspersky Lab teams with ITU-T to strengthen IoT ... In January 2018, a new international standard on “Security capabilities supporting safety of the Internet of Things” officially came into play. The st...
How OlympicDestroyer malware was designed to confu... Kaspersky Lab’s Global Research and Analysis Team published the results of its own research into attacks by the OlympicDestroyer malware, providing te...
About the Author

Leave A Response