G0071 Orangeworm

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.² Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.¹

Item	Value
ID	G0071
Associated Names
Version	2.0
Created	17 October 2018
Last Modified	10 April 2024
Navigation Layer	View In ATT&CK® Navigator

Techniques Used

Domain	ID	Name	Use
enterprise	T1071	Application Layer Protocol	-
enterprise	T1071.001	Web Protocols	Orangeworm has used HTTP for C2.³
enterprise	T1021	Remote Services	-
enterprise	T1021.002	SMB/Windows Admin Shares	Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.²

Software

ID	Name	References	Techniques
S0099	Arp	²	Remote System Discovery System Network Configuration Discovery
S0106	cmd	²	Windows Command Shell:Command and Scripting Interpreter File and Directory Discovery File Deletion:Indicator Removal Ingress Tool Transfer Lateral Tool Transfer System Information Discovery
S0100	ipconfig	²	System Network Configuration Discovery
S0236	Kwampirs	²	Local Account:Account Discovery Windows Service:Create or Modify System Process Deobfuscate/Decode Files or Information Fallback Channels File and Directory Discovery Ingress Tool Transfer Masquerade Task or Service:Masquerading Network Share Discovery Encrypted/Encoded File:Obfuscated Files or Information Binary Padding:Obfuscated Files or Information Password Policy Discovery Domain Groups:Permission Groups Discovery Local Groups:Permission Groups Discovery Process Discovery SMB/Windows Admin Shares:Remote Services Remote System Discovery Rundll32:System Binary Proxy Execution System Information Discovery System Network Configuration Discovery System Network Connections Discovery System Owner/User Discovery System Service Discovery
S0039	Net	²	Domain Account:Account Discovery Local Account:Account Discovery Additional Local or Domain Groups:Account Manipulation Local Account:Create Account Domain Account:Create Account Network Share Connection Removal:Indicator Removal Network Share Discovery Password Policy Discovery Domain Groups:Permission Groups Discovery Local Groups:Permission Groups Discovery SMB/Windows Admin Shares:Remote Services Remote System Discovery System Network Connections Discovery System Service Discovery Service Execution:System Services System Time Discovery
S0104	netstat	²	System Network Connections Discovery
S0103	route	²	System Network Configuration Discovery
S0096	Systeminfo	²	System Information Discovery

References

Pablo Rincón Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024. ↩
Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩↩↩↩↩↩↩↩↩↩
Symantec Security Response Attack Investigation Team. (2018, April 23). Orangeworm: Indicators of Compromise. Retrieved July 8, 2018. ↩