New APT ChamelGang Targets Energy, Aviation, and Government Sectors

guest · Oct 1, 2021

New APT ChamelGang Targets Russian Energy, Aviation Orgs
...and employs a variety of malware to steal data from compromised networks.
October 1, 2021
https://threatpost.com/apt-chamelgang-targets-russian-energy-aviation/175272/

A new APT group has emerged that’s specifically targeting the fuel and energy complex and aviation industry in Russia, exploiting known vulnerabilities like Microsoft Exchange Server’s ProxyShell and leveraging both new and existing malware to compromise networks.

Researchers at security firm Positive Technologies have been tracking the group, dubbed ChamelGang for its chameleon-like capabilities, since March. Though attackers mainly have been seen targeting Russian organizations, they have attacked targets in 10 countries so far, researchers said in a report by company researchers Aleksandr Grigorian, Daniil Koloskov, Denis Kuvshinov and Stanislav Rakovsky published online Thursday.
Click to expand...

To avoid detection, ChamelGang hides its malware and network infrastructure under legitimate services of established companies like Microsoft, TrendMicro, McAfee, IBM and Google in a couple of unique ways, researchers observed.

The attackers also appear malware-agnostic when it comes to tactics, using both known malicious programs such as FRP, Cobalt Strike Beacon, and Tiny Shell, as well as previously unknown malware ProxyT, BeaconLoader and the DoorMe backdoor, researchers said.
Click to expand...

Victims Across the Globe
Further threat intelligence following the investigation into attacks on the Russian companies revealed that ChamelGang’s activity has not been limited to that country.

Positive Technologies eventually identified 13 more compromised organizations in nine other countries – the U.S., Japan, Turkey, Taiwan, Vietnam, India, Afghanistan, Lithuania and Nepal. In the last four countries mentioned, attackers targeted government servers, they added.
Click to expand...

Positive Technologies:
Positive Technologies Uncovers New APT Group Attacking Russia's Fuel and Energy Complex and Aviation Production Industry

Additional Targets Include the United States, India, Nepal, Taiwan, and Japan, Where Government Servers Have Been Compromised in Some Cases
The group was named ChamelGang (from chameleon) for using plausible phishing domains and features of operating systems to mask malware and network infrastructure.

Positive Technologies experts have not yet linked ChamelGang to any specific country. All the organizations affected by attacks have been notified by the national CERTs.
A detailed report about ChamelGang, its tactics and the new malware discovered is available here: https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/
Click to expand...

Masters of Mimicry: new APT group ChamelGang and its arsenal

Trusted relationship attacks are rare today due to the complexity of their execution. Using this method in the first case, the ChamelGang group was able to achieve its goal and steal data from the compromised network. Also, the group tried to disguise its activity as legitimate, using OS features and plausible phishing domains. In addition, the attackers left a passive backdoor DoorMe in the form of a module for the IIS server.

We predict that the trend using the supply chain method will continue. New APT groups using this method to achieve their goals will appear on stage.
Click to expand...

Log in or Sign up

New APT ChamelGang Targets Energy, Aviation, and Government Sectors

guest Guest

Log in or Sign up

New APT ChamelGang Targets Energy, Aviation, and Government Sectors

guest Guest

Useful Searches