Loading story…
The FBI warned that attackers are conducting an ongoing campaign against software supply chain companies using the Kwampirs remote access trojan, compromising providers in order to reach their partners and customers. The alert said the activity affects organizations tied to industrial control systems supporting global energy generation, transmission, and distribution, and that victims have also been identified in the healthcare, energy, and financial sectors.
The campaign appears to expand on earlier reporting that linked Kwampirs and the Orangeworm group primarily to healthcare-focused supply chain intrusions. The FBI said code analysis found multiple similarities between Kwampirs and Shamoon/Disttrack, malware associated with the Iranian-linked APT33 group, while noting that Kwampirs itself has not been observed carrying a wiper component.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
On 2020-03-30, the FBI issued another Private Industry Notification on the Kwampirs campaign, saying it was the bureau's third alert on the group in 2020. The bureau also re-released related Flash alerts with additional information, including YARA rules, a technical report, and indicators of compromise.
In April 2019, Lab52 published a report that confirmed Symantec's earlier findings and the group's focus on the healthcare sector.
In April 2018, Symantec first publicly described the Kwampirs malware and reported that the Orangeworm group was targeting healthcare-related supply chain companies. Symantec assessed the campaign was primarily focused on healthcare, with secondary targeting of linked industries.
Symantec said the Orangeworm group had been operating since 2015, using the Kwampirs remote access trojan in its intrusion activity.
In its alert, the FBI provided indicators of compromise and YARA rules for Kwampirs and said new code analysis found numerous similarities between Kwampirs and Shamoon/Disttrack. The bureau noted that Kwampirs had not been observed with a wiper component.
The FBI said recent Kwampirs attacks had evolved beyond the earlier healthcare-focused activity to target companies in the industrial control systems sector, especially energy. It also said Kwampirs had been deployed against healthcare, energy, and financial sector organizations.
The FBI issued a security alert to the US private sector about an ongoing campaign using Kwampirs to target software supply chain providers in order to reach downstream partners and customers. The alert said downstream targets included organizations supporting industrial control systems for global energy generation, transmission, and distribution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
blog.reversinglabs.com
Open sourcezdnet.com
Open sourcezdnet.com
Open sourcesymantec-enterprise-blogs.security.com
Open sourcesymantec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The FBI issued a FLASH warning that **TeamPCP** is carrying out large-scale software supply chain compromises by trojanizing trusted developer and security tools, including **Trivy**, **KICS**, **LiteLLM**, and the **Telnyx Python SDK**. The campaign is designed to infiltrate CI/CD pipelines, cloud infrastructure, and security workflows, then steal high-value secrets such as cloud access tokens, API keys, SSH keys, and Kubernetes secrets. Reporting tied to the alert describes TeamPCP as a financially motivated group whose operations show persistence and scale more commonly associated with advanced threat actors. Authorities and researchers said the activity is linked to malware families including **CanisterWorm**, **SANDCLOCK**, **Mini Shai-Hulud**, and **Miasma**, which were used to establish persistence, exfiltrate credentials, and spread access into downstream victim environments. The FBI said the group has also engaged in extortion, published victim names on a leak site, and collaborated with other threat actors, raising the risk that stolen credentials will be reused long after the initial compromise. Defenders were urged to rotate exposed secrets, pin GitHub Actions to verified commit SHAs, hunt for worm-created repositories, harden CI/CD environments, and review published indicators such as domains, IP addresses, hashes, and related CVEs.
Jul 9, 2026
Criminal and espionage-aligned actors are increasingly using **supply chain compromise** as a primary access strategy, chaining vendor breaches, open-source package poisoning, credential theft, and follow-on ransomware/extortion into a “self-reinforcing” cycle. Reporting on a Group-IB trends assessment described how compromises of software packages and third parties (including examples such as the **Shai-Hulud NPM worm**, package poisoning activity, and SaaS/OAuth abuse) are used to inherit trusted access into customer environments—particularly via high-leverage providers like **MSPs** and widely used business platforms (HR/CRM/ERP). The same reporting highlighted an expected acceleration in attack speed and scale as adversaries apply AI-assisted discovery across vendors and CI/CD pipelines, and a shift toward **identity-centric intrusions** that blend into normal user activity. Separate reporting described a large cross-platform campaign attributed to **“RU-APT-ChainReaver-L”** that used compromised distribution infrastructure—specifically file-sharing mirror services **Mirrored.to** and **Mirrorace.org** and hijacked GitHub repositories—to redirect users through deceptive chains and deliver **infostealer malware** signed with valid certificates and hosted via legitimate cloud services. Researchers tied the activity to credential theft observed on dark web markets and reported infrastructure at significant scale (100+ domains spanning redirectors, infection pages, and C2), with frequent tooling changes to evade antivirus detection. Other items in the set were general commentary on third-party risk, mobile-app supply chain exposure, and healthcare targeting trends, and did not provide additional, specific details about the same incidents beyond reinforcing that third-party and supply chain weaknesses are increasingly exploited for downstream compromise.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026