Threat Actor Unknown origin

Chamelgang

Also known as: CamoFei

In Q2 2021, the PT Expert Security Center incident response team conducted an investigation in an energy company. The investigation revealed that the company's network had been compromised by an unknown group for the purpose of data theft. They gave the group the name ChamelGang (from the word "chameleon"), because the group disguised its malware and network infrastructure under legitimate services of Microsoft, TrendMicro, McAfee, IBM, and Google.

Indicators of Compromise 2

Domain catbox[.]moe Domain wasabisys[.]com

MITRE ATT&CK TTPs 8

T1021.001
Remote Desktop Protocol
Lateral Movement
 T1055.001
Dynamic-link Library Injection
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1105
Ingress Tool Transfer
Command And Control
 T1218.001
Compiled HTML File
Defense Evasion
 T1485
Data Destruction
Impact

Source Articles

Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
The China-linked threat actor Warlock, also known as Longlegs or Gold Salem, is actively exploiting vulnerabilities in on-premises Microsoft SharePoint Server deployments to gain initial access, deploy web shells, and achieve remote code execution. The group targets organizations in Portuguese- and Spanish-speaking countries, including critical infrastructure, government, and education sectors. After gaining access, Warlock uses DLL sideloading, legitimate cloud storage services for payload delivery, and the BYOVD technique with a vulnerable driver to disable security tools. The attackers then deploy ransomware at scale by staging payloads in the SYSVOL share and leveraging living-off-the-land techniques such as VS Code tunnels for persistence and lateral movement.
hacker-news ·6h ago