Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-06 02:11:41 UTC
Home > List all groups > List all tools > List all groups using tool Kwampirs
 Tool: Kwampirs
Names Kwampirs
Category Malware
Type Backdoor, Worm
Description
Kwampirs is a family of malware which uses SMB to spread. It typically will not
execute or deploy in environments in which there is no publicly available admin$ share.
It is a fully featured backdoor which can download additional modules. Typical C2
traffic is over HTTP and includes 'q=[ENCRYPTED DATA]' in the URI.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 23 April 2020
Download this tool card in JSON format
All groups using tool Kwampirs
Changed Name Country Observed
APT groups
 Orangeworm [Unknown] 2015-Jan 2020
1 group listed (1 APT, 0 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2543f59c-c8b9-4316-b66a-a30945a2a701
Page 1 of 2

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2543f59c-c8b9-4316-b66a-a30945a2a701
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2543f59c-c8b9-4316-b66a-a30945a2a701
Page 2 of 2

APT groups Orangeworm  [Unknown] 2015-Jan 2020
1 group listed (1 APT, 0 other, 0 unknown) 
   Page 1 of 2