S0236: Kwampirs

Kwampirs is a backdoor Trojan used by Orangeworm. Kwampirs has been found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines.[1] Kwampirs has multiple technical overlaps with Shamoon based on reverse engineering analysis.[2]

EnterpriseS0236MalwareObject v1.2ModifiedApr 11, 2024, 01:44 UTC (UTC+00:00)

S0236: Kwampirs describes [Kwampirs](https://attack.mitre.org/software/S0236) is a backdoor Trojan used by [Orangeworm](https://attack.mitre.org/groups/G0071). [Kwampirs](https://attack.mitre.org/software/S0236) has been found on machines which had software installed for the use and control of high-tech imaging devices such as X-Ray and MRI machines.(Citation: Symantec Orangeworm April 2018) [Kwampirs](https://attack.mitre.org/software/S0236) has multiple technical overlaps with [Shamoon](https://attack.mitre.org/software/S0140) based on re...

Executive priority

S0236: Kwampirs is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0236: Kwampirs by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0236: Kwampirs appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Kwampirs

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques22 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1069.002	Domain GroupsSub-technique	Kwampirs collects a list of domain groups with the command `net localgroup /domain`.[1]
Enterprise	T1087.001	Local AccountSub-technique	Kwampirs collects a list of accounts with the command `net users`.[1]
Enterprise	T1135	Network Share Discovery	Kwampirs collects a list of network shares with the command `net share`.[1]
Enterprise	T1140	Deobfuscate/Decode Files or Information	Kwampirs decrypts and extracts a copy of its main DLL payload when executing.[1]
Enterprise	T1007	System Service Discovery	Kwampirs collects a list of running services with the command `tasklist /svc`.[1]
Enterprise	T1083	File and Directory Discovery	Kwampirs collects a list of files and directories in C:\ with the command `dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp"`.[1]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.CitationSymantec Security Center Trojan.Kwampirs
Enterprise	T1543.003	Windows ServiceSub-technique	Kwampirs creates a new service named WmiApSrvEx to establish persistence.[1]
Enterprise	T1033	System Owner/User Discovery	Kwampirs collects registered owner details by using the commands `systeminfo` and `net config workstation`.[1]
Enterprise	T1018	Remote System Discovery	Kwampirs collects a list of available servers with the command `net view`.[1]
Enterprise	T1021.002	SMB/Windows Admin SharesSub-technique	Kwampirs copies itself over network shares to move laterally on a victim network.[1]
Enterprise	T1027.001	Binary PaddingSub-technique	Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.[1]
Enterprise	T1105	Ingress Tool Transfer	Kwampirs downloads additional files from C2 servers.CitationSymantec Security Center Trojan.Kwampirs
Enterprise	T1082	System Information Discovery	Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands `systeminfo`, `net config workstation`, `hostname`, `ver`, `set`, and `date /t`.[1]
Enterprise	T1036.004	Masquerade Task or ServiceSub-technique	Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.[1]
Enterprise	T1218.011	Rundll32Sub-technique	Kwampirs uses rundll32.exe in a Registry value added to establish persistence.[1]
Enterprise	T1057	Process Discovery	Kwampirs collects a list of running services with the command `tasklist /v`.[1]
Enterprise	T1049	System Network Connections Discovery	Kwampirs collects a list of active and listening connections by using the command `netstat -nao` as well as a list of available network mappings with `net use`.[1]
Enterprise	T1016	System Network Configuration Discovery	Kwampirs collects network adapter and interface information by using the commands `ipconfig /all`, `arp -a` and `route print`. It also collects the system's MAC address with `getmac` and domain configuration with `net config workstation`.[1]
Enterprise	T1201	Password Policy Discovery	Kwampirs collects password policy information with the command `net accounts`.[1]
Enterprise	T1008	Fallback Channels	Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.[1]
Enterprise	T1069.001	Local GroupsSub-technique	Kwampirs collects a list of users belonging to the local users and administrators groups with the commands `net localgroup administrators` and `net localgroup users`.[1]

Associated objects

Groups, software, and campaigns

G0071: Orangeworm

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.[1] Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.[2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.2
Created: Oct 17, 2018, 00:14 UTC (UTC+00:00)
Modified: Apr 11, 2024, 01:44 UTC (UTC+00:00)
Raw hash: 7621a6f0dbb97861...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.2	Apr 11, 2024, 01:44 UTC (UTC+00:00)	Current bundle	`7621a6f0dbb9…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	Apr 11, 2024, 01:44 UTC (UTC+00:00)	Older bundle	`7621a6f0dbb9…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Symantec Orangeworm April 2018
Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
Open source URL
[2]
Cylera Kwampirs 2022
Pablo Rincón Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024.
Open source URL
[3]
Kwampirs
(Citation: Symantec Orangeworm April 2018)
[4]
mitre-attackS0236
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use