HOMETHREATSKwampirs
APT / THREAT GROUP

Kwampirs

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Kwampirs is a family of malware which uses SMB to spread. It typically will not execute or deploy in environments in which there is no publicly available admin$ share. It is a fully featured backdoor which can download additional modules. Typical C2 traffic is over HTTP and includes "q=[ENCRYPTED DATA]" in the URI.

Threat Analysis

Kwampirs is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→http://www.documentcloud.org/documents/6821581-FLASH-CP-000111-MW-Downgraded-Version.html
→https://blog.reversinglabs.com/blog/unpacking-kwampirs-rat
→https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf
→https://resources.cylera.com/new-evidence-linking-kwampirs-malware-to-shamoon-apts
→https://thehackernews.com/2022/03/researchers-find-new-evidence-linking.html

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.kwampirsKwampirs

External Intelligence

Malpedia: win.kwampirs

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Kwampirs