Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
What appears to be the main backdoor of the group is also a VBS file (tracked by Proofpoint Emerging Threats as CageyChameleon)... In the cases observed by us... the compromised host performs a one-time communication with the C2 to download a VBS payload identified as VBS/CageyChameleon by Proofpoint’s Emerging Threats service.
“The CageyChameleon (aka CabbageRAT) family has expanded its functionality but still operates as a victim-profiling framework, exfiltrating running processes and host information while setting up the potential to launch subsequent tooling loaded from the command-and-control server.”
20 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers make first contact through LinkedIn and Telegram, sometimes using previously compromised accounts to appear more legitimate. They then share scheduling links via Calendly to set up meetings on fake platforms that closely copy the look and feel of Zoom, Google Meet, and Microsoft Teams.
On Windows machines, the ClickFix prompt instructs victims to press Win + X followed by “A” to open a terminal with administrator privileges, then paste and run a set of commands. These commands pull down two separate PowerShell scripts from attacker-controlled servers.
On Linux systems, victims are instructed to press Ctrl + Alt + T... and then they are prompted to paste and execute the following commands which include fetching and running an ELF downloader.
one distinct characteristic of the group is a relatively heavy use of VBS files both as downloaders and as backdoors.
The group pretends to be venture capital firms looking for investment partnerships, building trust with targets over time before delivering malicious payloads through counterfeit video conferencing platforms.
also lists the processes running on target computer, looking for specific strings: "hudongf" or "qhsafe"
20 → Download, Base64-decode, and XOR-decrypt a secondary VBS payload, which is then executed in memory.
The first script downloads a VBScript file, writes it to the temporary directory, and executes it twice using wscript.exe, while also adding the C:\Users directory to Windows Defender’s exclusion list and restarting the WinDefend service to suppress any alerts.
148 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Victim profiling and reconnaissance framework used to exfiltrate host/process information and enable follow-on tooling fetched from C2.
A VBS-based payload used by the CryptoCore threat actor as a downloader/backdoor. It collects host profiling data such as username, hostname, OS version, time zone, CPU, network adapter details, execution path, and running processes, and communicates with the C2 for follow-on payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.