camofei
CamoFei is a China-associated threat actor assessed by TeamT5 to have been active since at least 2019. TeamT5 linked the group to use of a stolen digital certificate attributed to “coolschool,” which was also used to sign Cobalt Strike and BYOVD-related malware uploaded to VirusTotal, and reported that the group conducted espionage, denial-of-service, and ransomware activity. TeamT5 also reported that the group’s CatB ransomware payload was signed with the same “coolschool” certificate. SentinelOne tracks a related activity cluster as ChamelGang and reported attacks against organizations in the U.S., Brazil, India, Russia, Taiwan, and Japan, including the Presidency of Brazil and the All-India Institute of Medical Sciences (AIIMS). More recent reporting cited in the content links Warlock ransomware activity exploiting a Microsoft SharePoint zero-day to a longer-running China-based nexus associated with CamoFei/ChamelGang. Observed tradecraft in the broader linked activity includes DLL sideloading, use of custom command-and-control infrastructure, and BYOVD-based defense evasion using a renamed vulnerable 2016 Baidu antivirus driver to disable security software.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Where they're from
Attributed origin per open-source reporting.
- CN
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linked to ransomware activity impacting US firms and exploiting a SharePoint zero-day.
China-nexus group (per TeamT5/SentinelOne) active since at least 2019 spanning espionage, DDoS, and ransomware; associated with the stolen "coolschool" certificate used to sign Cobalt Strike/BYOVD tooling and the CatB ransomware payload; described as targeting multiple countries and high-profile entities.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.