ChamelGang (CamoFei) – Threat Actor

Overview

At the core of ChamelGang’s operations is their methodical approach to initial access. The group often uses phishing campaigns to target high-value individuals within organizations, tricking them into executing malicious payloads. These campaigns are meticulously crafted to exploit vulnerabilities in human behavior and organizational defenses. Additionally, ChamelGang has been observed using exploit public-facing applications to gain unauthorized access, leveraging known vulnerabilities in software that is accessible over the internet. Once inside a network, ChamelGang employs various execution techniques to solidify their foothold. They commonly utilize command and scripting interpreters like PowerShell to execute their payloads, allowing them to perform a range of malicious activities under the radar. Scheduled tasks are also frequently created to ensure their malware runs at specific intervals, maintaining persistence and avoiding detection. Persistence is a key aspect of ChamelGang’s strategy. They employ tactics such as modifying registry run keys and placing malicious executables in startup folders to ensure their malware persists across system reboots. This approach allows them to maintain control over compromised systems and continuously exploit their access. Privilege escalation is another critical phase in ChamelGang’s operations. The group utilizes exploitation for privilege escalation, taking advantage of software vulnerabilities or misconfigurations to elevate their access levels. Additionally, they may engage in access token manipulation to gain higher privileges and further entrench themselves within the network. To evade detection, ChamelGang employs various defense evasion tactics. They often use obfuscated files or information to hide their malware from security solutions, making it harder for defenders to identify and mitigate their presence. File and directory discovery techniques are also used to navigate and map the target environment while avoiding detection. ChamelGang’s activities frequently involve credential access operations. They utilize credential dumping techniques to extract authentication information from compromised systems, which can then be used to further infiltrate the network or launch additional attacks. In some cases, brute force methods are employed to guess and capture user credentials. As they progress through their attack, ChamelGang performs extensive discovery to understand the target environment. They use network service scanning and system information discovery to identify critical assets and vulnerabilities that can be exploited for further exploitation. Lateral movement is another key phase of ChamelGang’s strategy. They often use Remote Desktop Protocol (RDP) to navigate within the network and access additional systems. They also exploit Windows Admin Shares to move laterally and gather data across multiple systems. The group’s collection tactics involve data from information repositories and input capture techniques to gather valuable information. This data is meticulously staged for exfiltration, often sent back to the attackers through established command and control channels. Finally, ChamelGang’s operations often culminate in impactful actions such as data encryption for impact. They use ransomware like CatB to encrypt critical data, disrupting organizational operations and demanding ransom payments. This tactic not only causes significant operational disruption but also serves as a form of financial extortion.  

References:

• ChamelGang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware