- Category
- State · Attributed to a state or working for one.
- Origin
- China(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2021
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0181 · chamelgang
ChinaWhat it is
In Q2 2021, the PT Expert Security Center incident response team conducted an investigation in an energy company. The investigation revealed that the company's network had been compromised by an unknown group for the purpose of data theft. They gave the group the name ChamelGang (from the word "chameleon"), because the group disguised its malware and network infrastructure under legitimate services of Microsoft, TrendMicro, McAfee, IBM, and Google.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Sunrise Panda
- Other names
- ChamelGang, CamoFei
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Afghanistan, Brazil, India, Japan, Lithuania, Nepal, Russia, Taiwan, Türkiye, United States, Vietnam
- Sectors
- Aviation, Energy, Government
Tools
The tools and malware families the sources tie to it.
- 7-Zip
- BeaconLoader
- Cobalt Strike
- DoorMe
- FRP
- ProxyT
- Tiny SHell
- Unknown Logger
- Xpert
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de