Pierluigi Paganini
April 23, 2018
Security experts at Symantec have published a report on the activity of a cyber espionage group tracked as Orangeworm that targets healthcare organizations.
“Symantec has identified a previously unknown group called Orangeworm that has been observed installing a custom backdoor called Trojan.Kwampirs within large international corporations that operate within the healthcare sector in the United States, Europe, and Asia.” states the report published by Symantec.
“First identified in January 2015, Orangeworm has also conducted targeted attacks against organizations in related industries as part of a larger supply-chain attack in order to reach their intended victims.”
Orangeworm was first spotted in January 2015, it appears to be focused on the healthcare industry, 40% of the targets belong to this industry
The hackers also targeted including IT (15%), manufacturing (15%), logistics (8%), and agriculture (8%) industries, but in all the cases the victims are part of the supply chain for healthcare entities.
Most of the victims are located in the United States (17%), followed by Saudi Arabia and India, anyway Orangeworm hit organization in many countries including Philippines, Hungary, United Kingdom, Turkey, Germany, Poland, Hong Kong, Sweden, Canada, France.
Orangeworm targeted a small number of victims in 2016 and 2017, but infections most affected large international corporations in several countries.
The hackers use a custom backdoor tracked as Trojan.Kwampirs to remotely control infected machine on the compromised network.
Initially, the backdoor is used as a reconnaissance tool, if compromised machine contains data of interest the backdoor “aggressively” spread among other systems with open network shares.
“The backdoor also collects some rudimentary information about the compromised computer including some basic network adapter information, system version information, and language settings.” continues the analysis.
“Orangeworm likely uses this information to determine whether the system is used by a researcher or if the victim is a high-value target. Once Orangeworm determines that a potential victim is of interest, it proceeds to aggressively copy the backdoor across open network shares to infect other computers. “
The experts observed attackers run a wide range of commands within the compromised systems:
The Kwampirs backdoor was discovered by Symantec on machines hosting software used for high-tech imaging devices, such as MRI and X-Ray machines. It was also discovered on devices used to assist patients in completing consent forms.
Experts highlighted that the methods used by Kwampirs to propagate over the target network are particularly “noisy,” this suggests Orangeworm is not overly concerned with being discovered.
At the time of the report, the experts still haven’t determined the real motivation of the attackers or their origin, but even if they are conducting cyber espionage there is no evidence that the operation is backed by a nation-state actor.
Experts noted that the actors behind Orangeworm do not appear to be concerned about their activities being detected.
“While Orangeworm is known to have been active for at least several years, we do not believe that the group bears any hallmarks of a state-sponsored actor—it is likely the work of an individual or a small group of individuals. There are currently no technical or operational indicators to ascertain the origin of the group.” concluded Symantec.
Further information, including Indicators of Compromise, are included in the report.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – Orangeworm hackers, cybercrime)
[adrotate banner=”5″]
[adrotate banner=”13″]
