Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа Orangeworm
Риски
Каталоги
MITRE ATT&CK
Преступная группа
Orangeworm
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

Orangeworm

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018) Reverse engineering of Kwampirs, directly associated with Orangeworm activity, indicates significant functional and development overlaps with Shamoon.(Citation: Cylera Kwampirs 2022)
ID: G0071
Associated Groups: 
Version: 2.0
Created: 17 Oct 2018
Last Modified: 10 Apr 2024

Associated Group Descriptions
Name Description

Techniques Used
Domain ID Name Use
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

Orangeworm has used HTTP for C2.(Citation: Symantec Orangeworm IOCs April 2018)
Enterprise T1021 .002 Remote Services: SMB/Windows Admin Shares

Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.(Citation: Symantec Orangeworm April 2018)

Software
ID Name References Techniques
S0039 Net (Citation: Microsoft Net Utility) (Citation: Savill 1999) (Citation: Symantec Orangeworm April 2018) Domain Account, Local Account, Domain Groups, System Service Discovery, Network Share Discovery, Additional Local or Domain Groups, SMB/Windows Admin Shares, Local Account, Domain Account, System Network Connections Discovery, Local Groups, Network Share Connection Removal, Password Policy Discovery, Remote System Discovery, Service Execution, System Time Discovery
S0100 ipconfig (Citation: Symantec Orangeworm April 2018) (Citation: TechNet Ipconfig) System Network Configuration Discovery
S0099 Arp (Citation: Symantec Orangeworm April 2018) (Citation: TechNet Arp) System Network Configuration Discovery, Remote System Discovery
S0104 netstat (Citation: Symantec Orangeworm April 2018) (Citation: TechNet Netstat) System Network Connections Discovery
S0096 Systeminfo (Citation: Symantec Orangeworm April 2018) (Citation: TechNet Systeminfo) System Information Discovery
S0106 cmd (Citation: Symantec Orangeworm April 2018) (Citation: TechNet Cmd) (Citation: TechNet Copy) (Citation: TechNet Del) (Citation: TechNet Dir) System Information Discovery, File and Directory Discovery, Lateral Tool Transfer, Windows Command Shell, File Deletion, Ingress Tool Transfer
S0103 route (Citation: Symantec Orangeworm April 2018) (Citation: TechNet Route) System Network Configuration Discovery
S0236 Kwampirs (Citation: Cylera Kwampirs 2022) (Citation: Symantec Orangeworm April 2018) System Owner/User Discovery, Rundll32, Encrypted/Encoded File, Local Account, Windows Service, Domain Groups, System Service Discovery, Network Share Discovery, System Information Discovery, Deobfuscate/Decode Files or Information, SMB/Windows Admin Shares, Binary Padding, System Network Configuration Discovery, File and Directory Discovery, Masquerade Task or Service, System Network Connections Discovery, Process Discovery, Local Groups, Password Policy Discovery, Remote System Discovery, Ingress Tool Transfer, Fallback Channels

References

  1. Pablo Rincón Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024.
  2. Symantec Security Response Attack Investigation Team. (2018, April 23). Orangeworm: Indicators of Compromise. Retrieved July 8, 2018.
  3. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.