A security report released on April 23, 2018 found that there was a growing threat presented by Orangeworm, a cybercrime alliance that was going after organizations within healthcare and similar fields using a backdoor known as Kwampirs.
Kwampirs is a Trojan horse, as indicated by the NJ Cybersecurity & Communications Integration Cell. When attackers deploy this malware, they are able to remotely access the devices that are infected with it. Once the attackers access the machines and execute the Trojan, it begins to decrypt and extract a copy of its primary dynamic link library (DLL) payload. (What is DLL injection? DLL injection is a technique that is often used for Trojans. The pen-testing industry blog Penetration Testing Lab noted that DLL injection enables an intruder to run whatever script they want within another process’s address space. In the event that the process involved has heightened privileges, the nefarious party might be able to run sinister code within a DLL file that would further increase their privileges and, in turn, allow them to inflict widespread damage.)
