Kwampirs
Software · ATTACK:enterprise:S0236
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0236",
"title": "Kwampirs",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0236",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--c2417bab-3189-4d4d-9d60-96de2cdaf0ab",
"external_id": "S0236",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2024-04-11T01:44:05.770Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Kwampirs"
},
{
"source_name": "Cylera Kwampirs 2022",
"url": "https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf"
},
{
"source_name": "Symantec Orangeworm April 2018",
"url": "https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--040ff1f7-493d-4762-a9bb-db143a971464
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11fef36d-e857-4e0e-93e0-f0361df83ced
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2beb9f29-a94b-469a-870e-2e2072bf941c
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d822996-4574-402d-8d0f-1cfc0e963850
Symantec Orangeworm April 2018ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:S0236
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36aad32e-5300-4db0-b5a2-8b7442123db1
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36f0915e-66aa-4062-b909-35414c639ae1
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e07996d-c9d9-49a8-9800-94daf69cd3b3
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5550ef5e-a34c-4055-b7be-dd41d76ef7b1
Symantec Security Center Trojan.KwampirsATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56c41e3f-3d8f-4f36-9885-955952e700db
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64006d31-51ea-4908-8b09-2650fdc6b4f8
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71fd7b73-462f-4629-8d95-59d0129b1503
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9663d78b-0a81-42af-93b0-8e62cc3af2d7
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97d77da2-9e26-4168-b14c-9d26093aa5be
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b102737-2d47-4dd5-b4f2-2a323c506cfb
Symantec Security Center Trojan.KwampirsATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8dc6cca-3ede-4110-baf1-8ce53fb655a9
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abdf9690-d578-4f86-a2cc-295c2789bb4e
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3877b02-98e4-4c4a-8034-5af9f1e65c2c
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0f3f4f3-e435-443f-aa89-18afb0115055
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c195f2cb-deff-400e-b89e-8625deaa9817
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfa38151-4972-4355-8071-dd36cb1be880
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1201
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ddda59d4-5455-4d42-901b-b7a227a8a023
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2317e9b-9301-4c44-959f-94d66858136c
Symantec Orangeworm April 2018ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb243cd7-7dec-4836-a341-c9e30c0099ee
Symantec Orangeworm April 2018