Loading malware…
CatB, also known as CatB99 and Baxtoy, is a Windows ransomware family first observed in late 2022. It uses a staged execution chain in which a loader performs anti-analysis and anti-virtualization checks before launching the ransomware payload. Reported checks include host CPU, memory, and disk-capacity validation intended to avoid sandboxed or low-resource environments.
A defining characteristic of CatB is its abuse of the Microsoft Distributed Transaction Coordinator service to execute through DLL hijacking, including phantom DLL loading and DLL side-loading behavior. The loader has been observed placing a malicious DLL where the trusted service will load it, modifying service configuration for automatic startup, and causing the payload to run in the context of a trusted Windows service, including with elevated privileges. This provides both defense evasion and persistence.
Once active, CatB enumerates files across local volumes and encrypts selected data while excluding some file types likely chosen to preserve system stability or avoid low-value targets. Reported behavior indicates full encryption for smaller targeted files and partial encryption for larger files or some non-excluded file types. Unlike many ransomware families, CatB typically does not append a new extension to encrypted files or rely on separate ransom-note files; instead, it prepends the ransom note to the beginning of each encrypted file, which can corrupt file headers and render files unusable.
CatB has also been reported to attempt theft of browser and Windows Mail data, including credentials, session-related information, browsing history, profile data, and other user artifacts, indicating functionality beyond pure file encryption. Similarities in code and ransom-note strings have led researchers to suggest a relationship with Pandora ransomware, possibly as a rebrand or evolution.
CatB has been associated by multiple researchers with the China-linked threat actor ChamelGang, also known as CamoFei, based on overlaps in code, staging mechanisms, certificates, strings, and other malware artifacts. Reported victimology includes government and critical-sector organizations, including incidents affecting the Presidency of Brazil and the All India Institute of Medical Sciences. CatB is notable as an example of ransomware used in operations assessed to overlap with espionage activity, disruption, misattribution, and evidence destruction rather than conventional financially motivated cybercrime alone.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We discovered strong indicators pointing to these institutions as being targeted using ChamelGang’s CatB ransomware.
"Its ransomware payload, known as CatB, had been signed with the same coolschool certificate."
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The CatB ransomware sample discussed in this Spotlight uses a DLL Side-Loading vulnerability in a trusted Windows service called MSDTC.
The malware then abuses the MSDTC service, manipulating the permissions and startup parameters. As a result, the system will inject the malicious oci.dll into the service’s executable (msdtc.exe) when the MSDTC service is restarted. | Upon execution, CatB payloads rely on DLL search order hijacking to drop and load the malicious payload. The dropper (versions.dll) drops the payload (oci.dll) into the System32 directory.
First, the dropper is distributed in the form of a UPX-packed DLL (versions.dll). This dropper deposits the second DLL payload (oci.dll) onto the target host.
The ChamelGang group repeatedly deployed ransomware and encryptors “for the purposes of financial gain, disruption, distraction, misattribution, or removal of evidence” ... The specific use of ransomware also allows APT groups to destroy evidence of their espionage efforts and force organizations to focus on data restoration instead of investigating how hackers gained initial entry.
As a result, the system will inject the malicious oci.dll into the service’s executable (msdtc.exe) when the MSDTC service is restarted.
Before the ransomware is executed, its loader component performs basic evasion checks to ensure the sample is not running in an analysis environment, such as a sandbox.
The first one checks the number of CPU cores... The second performed anti-VM technique checks for the amount of main memory... For the third and final check, the sample extracts the size of the hard drive...
The CatB ransomware sample discussed in this Spotlight uses a DLL Side-Loading vulnerability in a trusted Windows service called MSDTC.
The malware then abuses the MSDTC service, manipulating the permissions and startup parameters. As a result, the system will inject the malicious oci.dll into the service’s executable (msdtc.exe) when the MSDTC service is restarted. | Upon execution, CatB payloads rely on DLL search order hijacking to drop and load the malicious payload. The dropper (versions.dll) drops the payload (oci.dll) into the System32 directory.
CatB performs three primary checks in an attempt to determine if the payload is being executed within a virtual environment. These are direct checks for type and size of physical RAM, type and size of physical hard disks, and checking for odd or anomalous combinations of processors and cores.
Once CatB passes all the checks for the second time, the ransomware tries to find interesting files to encrypt... searching for files across multiple drives.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware payload attributed by TeamT5 to the China-linked group CamoFei; notable for being signed with the stolen 'coolschool' certificate also seen in later Warlock-adjacent tooling.
Ransomware associated with ChamelGang and used in attacks against the Presidency of Brazil and India’s AIIMS.
Ransomware that the content says exploits DLL hijacking vulnerabilities for improved concealment.
Ransomware used in the 2022 attacks on the Presidency of Brazil and the All India Institute of Medical Sciences (AIIMS), attributed by the researchers to ChamelGang based on malware code overlaps with other tools used by the group.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.