ChamelGang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware
2024-06-26 • Sentinel One •
https://www.sentinelone.com/labs/chamelgang-attacking-critical-infrastructure-with-ransomware/
Attachments
SentinelLabs and Recorded Future described a secondary ransomware activity cluster that abused Jetico BestCrypt and Microsoft BitLocker against 37 organizations between early 2021 and mid-2023, mostly in U.S. manufacturing but also in education, finance, healthcare, and legal environments. The report says attribution for this cluster remains unclear, although some artifacts overlap with past intrusions tied to suspected Chinese and North Korean APT activity. It separates that cluster from ChamelGang’s CatB ransomware activity against Indian, Brazilian, East Asian, and aviation-sector targets. For DPRK tracking, the relevant point is the unresolved overlap with North Korea-linked artifacts, not a direct Lazarus attribution.