Pierluigi Paganini March 31, 2020

For the third time in a few weeks, the FBI has issued an alert about supply chain attacks carried out by nation-state actors using the Kwampirs malware.

The FBI has issued an alert about supply chain attacks using the Kwampirs malware as part of a hacking campaign carried out on a global scale by state-sponsored hackers.

The FBI has issued an alert on Monday about state-sponsored hackers using the Kwampirs malware to attack supply chain companies and other industry sectors as part of a global hacking campaign.

Feds warn of Coronavirus attacks aimed at organizations in the healthcare industry.

“Since at least 2016, the FBI has observed an Advanced Persistent Threat (APT) actor conduct a global network exploitation campaign using the Kwampirs Remote Access Trojan (RAT) and is providing additional, non-technical information in an effort to highlight key objectives of the actor campaign. This information, along with previously released FBI Liaison Alert System (FLASH) messages, is intended to enhance the network defense posture of public and private partners.” reads the alert issued by FBI.

The Kwampirs RAT is a modular RAT worm used as a reconnaissance tool, if compromised machine contains data of interest the backdoor “aggressively” spread among other systems with open network shares.

The RAT was first analyzed by Symantec researchers in April 2018, when the researchers uncovered the activity of a cyber espionage group tracked as Orangeworm that targeted organizations in the healthcare sector.

“The Kwampirs RAT is a modular RAT worm that gains system access to victim machines and networks, with the primary purpose of gaining broad, yet targeted, access to victim companies enable follow-on computer network exploitation (CNE) activities.” continues the alert. “Through victimology and forensic analysis, the FBI found heavily targeted industries include healthcare, software supply chain, energy, and engineering across the United States, Europe, Asia, and the Middle East. Secondary targeted industries include financial institutions and prominent law firms.”

The FBI already published two Flash alerts, one containing YARA rules related to the Kwampirs malware and a complete technical report of the threat.

According to the FBI, the group behind these attacks has been active since 2016, but a report published in 2018 by Symantec revealed that the Orangeworm APT was first spotted in January 2015.

Symanted pointed out that the APT group appears to be focused on the healthcare industry, 40% of the targets belong to this industry

The FBI confirmed that the APT group broke into target networks belonging to major transnational healthcare companies, hospital organizations, and other organizations in other industries.

“Kwampirs operations against global healthcare entities have been effective, gaining broad and sustained access to targeted entities. Targeted entities range from major transnational healthcare companies to local hospital organizations. The scope of infections has ranged from localized infected machine(s) to enterprise infections. During these campaigns, the Kwampirs RAT performed daily command and control communications with malicious IP addresses and domains that were hard-coded in the Kwampirs RAT malware. The FBI assesses Kwampirs actors gained access to a large number of global hospitals through vendor software supply chain and hardware products. Infected software supply chain vendors included products used to manage industrial control system (ICS) assets in hospitals.” states the FBI.

Another element that emerged from the FBI alert are the similarities between the Kwampirs malware and Disttrack, which is a wiper also known as Shamoon, that was employed in attacks attributed to Iran-linked APT groups.

At the time is not clear is the FBI issued the alert following recent attacks targeting healthcare organizations.

Pierluigi Paganini

(SecurityAffairs – FBI, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]