New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia | Symantec Blogs

Symantec reports on Orangeworm, a previously undocumented threat group deploying the custom Kwampirs backdoor primarily against healthcare organizations and related supply-chain partners across multiple countries; Kwampirs persists by creating a Windows service, propagates aggressively via network shares (including legacy systems), collects system/network reconnaissance data, and beacons to an embedded C2 list, while Symantec provides detections, IOCs, and guidance to protected customers.