CageyChameleon
Aliases: Cabbage RAT
- First seen
- 2021-04-15 00:00:00
- Malware type
- backdoor, rat
- Family
- Malware family
- Profile updated
- 2026-07-07 12:46:58
Targeted industries: defense-and-aerospace government-and-public-sector financial-services
Context
CageyChameleon Malware is a VBS-based backdoor which has the capability to enumerate the list of running processes and check for the presence of several antivirus products. CageyChameleon will collect user host information, system current process information, etc. The collected information is sent back to the C2 server, and continue to initiate requests to perform subsequent operations.
Reports & references
- proofpoint.com — Ta444 Apt Startup Aimed At Your Funds (report)
- sansorg.egnyte.com — 3P3Hxfingl (report)
- blogs.jpcert.or.jp — Dangerouspassword (report)
- malpedia.caad.fkie.fraunhofer.de — Vbs.Cageychameleon (report)
- blogs.jpcert.or.jp — Spear Phishing Against Cryptocurrency Businesses (report)
- clearskysec.com — Cryptocore Lazarus Clearsky (report)
- github.com — Analysis.Md (report)
- proofpoint.com — Daily Ruleset Update Summary 20190314 (report)
- vb2020.vblocalhost.com — Unveiling The Cryptomimic (report)
- google.com — Url (report)
- Kaspersky — 105488 (report)
- atlas-cybersecurity.com — Cryptocore Cryptocurrency Exchanges Under Attack (report)
- mp.weixin.qq.com — Nnlqubpx8Xz3Hcr5U Isjq (report)
- cyberstruggle.org — Leeryturtlethreatreport 05 20 (report)
- clearskysec.com — Cryptocore Group (report)
- threatbook.cn — The%2520Nightmare%2520Of%2520Global%2520Cryptocurrency%2520Companies%2520 %2520Demystifying%2520The%2520%25E2%2580%259Cdangerouspassword%25E2%2580%259D%2520Of%2520The%2520Apt%2520Organization (report)
- clearskysec.com — Cryptocore Group (report)