kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

Chamelgang

also tracked as camo fei 1, longlegs 1, storm 2603 1

1 story · 1 in the wild · October 3, 2026 – October 3, 2026

evidence: 1 observed

how they got in

  • exposed service 1 · Oct 3

sectors

  • energy 1 · Oct 3
  • government 1 · Oct 3
  • telecom 1 · Oct 3

geography

  • africa 1 · Oct 3
  • europe 1 · Oct 3
  • latin america 1 · Oct 3
  • portugal 1 · Oct 3
  • spain 1 · Oct 3

malware and tools

  • visual studio code tunnels 1 · Oct 3
  • warlock ransomware 1 · Oct 3

techniques

  • edr removal 1 · Oct 3
  • lateral movement 1 · Oct 3
  • persistence 1 · Oct 3
  • privilege escalation 1 · Oct 3

attack phases seen

  • Impact 1 · Oct 3
  • Initial access 1 · Oct 3
  • Lateral movement 1 · Oct 3
  • Persistence 1 · Oct 3
  • Privilege escalation 1 · Oct 3

what we reported, newest first, grouped by story

October 3, 2026

  • Warlock ransomware is still getting in through SharePoint, a year after ToolShell. Symantec tracks the China-nexus developer as Longlegs (aka Storm-2603, previously tied to CL-CRI-1040, CamoFei and ChamelGang), and reports at least four victims in the past two months across Portuguese- and Spanish-speaking countries in Europe, Africa and Latin America: a water utility, a telecoms provider, a regional government body and a university. In one critical-infrastructure intrusion the operators pushed a security-software killer to 40+ hosts in about two hours, then deployed Warlock on at least 33 hosts by staging it in the domain SYSVOL share and letting normal domain replication do the distribution. Tradecraft includes the vulnerable signed K7RKScan driver for EDR removal and Visual Studio Code tunnels for covert remote access (Symantec, The Record). · Oct 3 · observed · via exposed service · as longlegs, storm 2603, camo fei · Threat Activity & Malware