A newly documented threat group, dubbed ChamelGang, has been determined to be behind a strain of cyber-attacks targeting aviation, fuel, and energy productions throughout Russia, United States, Taiwan, Japan, and more. ChamelGang’s directive is to compromise the networks of these production facilities and exfiltrate the data off-site to be used in anyway the threat actors deem necessary. Intrusions from these threat actors began at the end of March and have continued throughout the year, leveraging several exploits including the popular ProxyChain exploit chain. In this cyberattack, ChamelGang breached a subsidiary organization by exploiting flaws in a Jboss Enterprise Application (CVE-2017-12149), which allowed actors to execute commands remotely, drop several malicious payloads, escalate system privileges, preform network reconnaissance, conduct lateral network movement, and finally dropping the ‘DoorMe’ backdoor. While the fuel industry is one of the largest targets in Russia, 84% of post-attack losses were either financial or sensitive information theft. CTAPT will start monitoring the movements of ChamelGang and craft updates as needed.