Hello, welcome to the Wednesday, April 1st, 2020 edition of the Sansonet Stormers. Stormcast,

my name is Johannes Ulrich, and today I'm recording from Jacksonville, Florida.

Quampiers or Orange Warm is back in the news. This is some targeted malware that has sort of come back occasionally.

This time the FBI released an update stating that one of the targets of this particular malware is also the healthcare sector,

which of course currently has other things to worry about.

One of the tricks that Comompeers uses is to infect software vendors and then essentially via the supply chain enter the actual target network.

This is really tricky to defend against because essentially the malware arrives as part of an update from a trusted

vendor and this is of course always very difficult to then investigate and figure out whether

or not this update was legitimate. So your standard anti-malver is probably not going to save

the day here. Old versions of Guam Peers are really well recognized by anti-malware is probably not going to save the day here. Old versions of Guampeers are

really well recognized by anti-maliver, but you're probably going to see the next one also

indicators of compromise that were published for past versions don't necessarily apply for

the next one. So how can you actually detect something like this? Well, there are

sort of two things I kind of spotted. First of all, it has to connect to some kind of command

control server. So these connections may be able to be spotted. It is not very chatty. One

of the write-ups talked about just one connection a day,

so that's likely going to fly under the radar. But in the past, it has used some pretty

artificial domain names, also like domain names within the dot tk, top-level domain. That's something

that may stick out. Also, Quampere's likes to start

services on infected hosts, and then it also likes to reach out to admin shares, which may be probably

the easiest way to detect this particular infection. And while you're looking for it, you may find something else,

too. Just in general, when you're reading sort of write-ups about target malware like this,

...