Loading threat actor…
Chaya_006 is a tracked intrusion cluster associated with targeted, automated exploitation of internet-exposed devices running OpenWRT-derived software, including Lantronix serial-to-IP converters that use the LuCI web interface. The activity has been linked to exploitation of CVE-2025-67038, an unauthenticated OS command injection vulnerability in Lantronix EDS5000 devices, with timing consistent with patch reverse engineering because exploitation was observed after a vendor fix was issued but before public technical disclosure. The cluster’s behavior has been assessed as inconsistent with commodity botnets or generic internet-wide scanning. Observed tradecraft includes initial access through exploitation of edge-device vulnerabilities and brute-force activity against specific LuCI web application parameters rather than only standard remote-access services. The use of specialized scripts, automation, and device-focused information gathering indicates deliberate reconnaissance and tailored targeting of a narrow device class. The broader activity associated with Chaya_006 has focused on Lantronix devices and other OpenWRT-based edge systems. At high confidence, Chaya_006 appears to be an operational cluster rather than a publicly established nation-state designation, and currently available information does not support a definitive attribution to a specific government or criminal organization. Its dominant motivation is therefore not established from the available facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.