Chamelgang

Also known as: CamoFei, ChamelGang, Chamelgang, Sunrise Panda

In Q2 2021, the PT Expert Security Center incident response team conducted an investigation in an energy company. The investigation revealed that the company’s network had been compromised by an unknown group for the purpose of data theft. They gave the group the name ChamelGang (from the word “chameleon”), because the group disguised its malware and network infrastructure under legitimate services of Microsoft, TrendMicro, McAfee, IBM, and Google.

🌍 Country ["China"]
Aviation Energy

Targeted Victims

India Japan Nepal Russia Taiwan United States

Associated Operations

2022 2023-06 ChamelGang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware ChamelGang and ChamelDoH: A DNS-over-HTTPS implant https://stairwell.com/news/chamelgang-and-chameldoh-a-dns-over-https-implant/ https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/

Introduction

In Q2 2021, the PT Expert Security Center incident response team conducted an investigation in an energy company. The investigation revealed that the company’s network had been compromised by an unknown group for the purpose of data theft. They gave the group the name ChamelGang (from the word “chameleon”), because the group disguised its malware and network infrastructure under legitimate services of Microsoft, TrendMicro, McAfee, IBM, and Google.

Activities and Tactics

Targeted Sectors: Aviation, Energy

Country of Origin: 🇨🇳 [“China”]

Suspected Victims: India, Japan, Nepal, Russia, Taiwan, United States

Notable Campaigns

  • 2022
  • 2023-06
  • **ChamelGang & Friends Cyberespionage Groups Attacking Critical Infrastructure with Ransomware**
  • ChamelGang and ChamelDoH: A DNS-over-HTTPS implant
  • https://stairwell.com/news/chamelgang-and-chameldoh-a-dns-over-https-implant/
  • https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Unknown Logger
  • Xpert
  • 7-Zip:
  • BeaconLoader:
  • Cobalt Strike:
  • DoorMe:
  • FRP:
  • ProxyT:
  • Tiny SHell:

Attribution and Evidence

Country of Origin: [“China”] Additional attribution information pending cataloguing.

References

References pending cataloguing.