Loading threat actor…
CamoFei is a China-linked threat actor assessed active since at least 2019 and also tracked as ChamelGang. The group has been associated with a blend of espionage, disruptive activity, and ransomware operations, indicating an unusual overlap between state-aligned intrusion tradecraft and financially motivated post-compromise monetization. Reporting has linked the actor to use of a stolen code-signing certificate across multiple malware and tooling sets, including backdoors, Cobalt Strike-related tooling, BYOVD-enabled defense-evasion components, and ransomware payloads such as CatB. More recent reporting has suggested possible connections between this longer-running activity cluster and Warlock ransomware intrusions observed in 2025, although some of those links are inferential rather than definitively attributed. Observed tradecraft includes exploitation of public-facing systems for initial access, DLL sideloading to launch malicious loaders, custom command-and-control tooling, use of signed malware for trust abuse, and BYOVD to disable security products. The actor has also been associated with denial-of-service activity and ransomware deployment, demonstrating capabilities spanning reconnaissance, intrusion, defense evasion, post-exploitation, and exfiltration or disruptive impact. Victimology includes government and healthcare entities as well as organizations in multiple countries including the United States, Brazil, India, Russia, Taiwan, and Japan. Public reporting specifically noted targeting of the Presidency of Brazil and the All-India Institute of Medical Sciences. The group is notable for operating at the boundary between espionage-oriented Chinese intrusion activity and criminal-style ransomware behavior.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked to ransomware activity impacting US firms and exploiting a SharePoint zero-day.
China-nexus group (per TeamT5/SentinelOne) active since at least 2019 spanning espionage, DDoS, and ransomware; associated with the stolen "coolschool" certificate used to sign Cobalt Strike/BYOVD tooling and the CatB ransomware payload; described as targeting multiple countries and high-profile entities.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.