Hackers Target Supply Chain Companies with “Kwampirs” Malware

guest · Feb 13, 2020

Hackers Target Supply Chain Companies with “Kwampirs” Malware
February 12, 2020
https://www.cisomag.com/hackers-target-supply-chain-companies-with-kwampirs-malware/

The FBI recently gave a security warning to private organizations in the U.S. about an ongoing hacking campaign targeting software supply chain companies. It’s said that attackers are targeting companies with a remote access trojan (RAT) malware tracked as “Kwampirs”, according to a source.
Kwampirs Malware
Apart from attacks on supply chain software providers, hackers also deployed Kwampirs malware in attacks against companies in the health care, energy, and financial sectors.

Kwampirs malware was first discovered by Symantec in April 2018. It’s said that a hacking group named Orangeworm used Kwampirs to attack the health care, pharmaceutical, IT, manufacturing, agriculture, and logistics companies.
The FBI claims that Kwampirs malware has numerous similarities with “Shamoon”, a data-wiping malware developed by the APT33 hacking group.
Click to expand...

ZDNet: FBI warns about ongoing attacks against software supply chain companies

KWAMPIRS MALWARE
The Kwampirs malware was first described in a report published by US cyber-security firm Symantec in April 2018.
Symantec said Orangeworm had been in operation since 2015 and was focused on the healthcare industry primarily.

A Lab52 report released a year later, in April 2019, confirmed the Symantec findings and the group's focus on the healthcare industry.
NEW ATTACKS APPEAR TO BE TARGETING THE ICS ENERGY SECTOR
However, the FBI alert sent out last week specifically warns that attacks employing Kwampirs have now evolved to targeting companies in the ICS (Industrial Control Systems) sector, and especially the energy sector.

The FBI urged companies to scan networks for any signs of Kwampirs and report any infections.
Click to expand...

guest · Mar 25, 2020

ReversingLabs did a forensic analysis of attacks from the remote access trojan to understand the malware control structure
March 25, 2020
https://www.techrepublic.com/articl...t-kwampirs-rat-malware-with-new-list-of-iocs/

ReversingLabs has analyzed clues from attacks by the Kwampirs remote access trojan (RAT) to help software companies defend their organizations against this malware.

Organizations must protect their software development environment and make sure that their suppliers are not compromised, the security firm stated in "Unpacking Kwampirs RAT: From threat hunting to threat intelligence." Tomislav Peričin, the chief software architect and co-founder at ReversingLabs, wrote the analysis.
The security company used breadcrumbs left in the network configuration to document the malware network infrastructure that supported the attack carried out by the Orangeworm group. Symantec first identified the hackers and their weapon of choice in 2018.

The FBI warned recently [...] FBI said the same malware was also used in attacks against healthcare, energy, and financial companies.
Click to expand...

ReversingLabs states that from the threat analysis viewpoint, the most important part of this malware is its configuration because it is essentially a remote access trojan.
Understanding the attack
ReversingLabs collected data samples from Kwampirs attacks to write a reliable malware configuration parser that extracts network configurations from the samples.
Each of the Kwampirs samples collected by ReversingLabs came with a set of 200 control server URLs. Malicious operations are usually carried out in campaigns that share the same control server infrastructure. [...]
Improving security defenses
ReversingLabs created a list of indicators of compromise (IOC) based on this Kwampirs RAT analysis. Companies can use these IOCs to create new blocking firewall and intrusion detection rules and to search SIEM logs for infected endpoints.
Click to expand...

ReversingLabs: Unpacking the Kwampirs RAT

Conclusion
Protection from supply chain attacks is two-fold. Organizations must protect their development environment and ensure their suppliers are not compromised. Kwampirs RAT represents a targeted attack against the secure software supply chain, and needs to be closely monitored for new activity.

Warnings issued by the FBI are corroborated by our research presented here. The attackers are still using the same methods of infection, tools, and network infrastructure, which indicates that their activity is constant.
IOC list
The following links contain the data extracted from the collected samples. These IOCs can be used to improve the security of your organizations by creating blocking firewall and intrusion detection systems rules.
Click to expand...

guest · Mar 31, 2020

Kwampirs Targeted Attacks Involving Healthcare Sector
March 31, 2020
https://isc.sans.edu/diary/rss/25968

Last week, the FBI updated an advisory regarding the Kwampirs malware, pointing out the healthcare sector as one of its targets. Kwampirs isn't picky in its targeting. It has been observed going after various sectors (financial, energy, software supply chain, and healthcare, among others).

Kwampirs exhibits several behaviors that put it in the "Advanced Persistent Threat (APT)" category:

It is patient. Kwampirs does not launch fast "hit and run" attacks. Instead, it can infiltrate a network and only communicate daily, asking for updates. I took some networks three years to detect Kwampirs.

Kwampirs infiltrates software vendors and uses them to spread to customers. These supply chain attacks are well suited to target specific industries.

It does not have a clear financial motive, like stealing PII or payment card data. The malware has not been observed destroying or encrypting data for ransom.

Click to expand...

Kwampirs will likely enter your network undetected as part of a software update from a trusted vendor. Anti-malware solutions will detect past versions. But do not put too much trust in anti-malware to detect the next version that is likely tailored to your organization.

Refer to the FBI advisories I uploaded here for more detailed IOCs. [...]
Click to expand...

FBI Advisory: Kwampirs Malware (March 30, 2020)
(PDF): https://isc.sans.edu/diaryimages/Kwampirs_PIN_20200330-001.pdf

Log in or Sign up

Hackers Target Supply Chain Companies with “Kwampirs” Malware

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hackers Target Supply Chain Companies with “Kwampirs” Malware

guest Guest

guest Guest

guest Guest

Useful Searches