ChamelgangThreat actor
- CamoFei
In Q2 2021, the PT Expert Security Center incident response team conducted an investigation in an energy company. The investigation revealed that the company's network had been compromised by an unknown group for the purpose of data theft.From MISP Galaxy
Last reported 20 days ago, by Security Affairs4 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1505.003Web Shell
“Upon successfully finding a way in, the threat actors have been found to drop web shells that can target multiple versions of SharePoint.”
- T1136Create Account
“…re hosts by adding a fake-sounding admin account named SPSEPRDSetup, a decent bit of social camouflage since SharePoint really does create accounts with that kind of prefix.”
- T1543.003Windows Service
“…ntec found that the ransomware was delivered through normal domain replication traffic, with three systems capturing dfsrs.exe, the Windows service responsible for that replication, delivering the malicious files.”
- T1546.016Installer Packages
“The attackers then pulled three separate installer packages from two different hosting services within ninety minutes, suggesting they had backups ready in case one path got blocked.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure“…acks the group behind Warlock as Longlegs, also known as Storm-2603, and ties it back to older China-nexus clusters called CL-CRI-1040, CamoFei, and ChamelGang.”
-
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware“According to Symantec, Warlock shares overlaps with older activity clusters known as CL-CRI-1040, CamoFei, and ChamelGang.”
-
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks“…d by a China-based hacking group tracked as Longlegs and Storm-2603, which has been linked to malicious operations such as CL-CRI-1040, CamoFei, and ChamelGang.”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“Symantec has previously tied this group to older activity clusters known as CL-CRI-1040, CamoFei, and ChamelGang."”
Indicators in its reports
named in the reports above- mk[.]ggin 1 report
- scarnecchia[.]netin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.