Chaos

One of the more interesting functions of Chaos version 1.0 was its worming function, which allowed it to spread to all drives found on an affected system. This could permit the malware to jump onto removable drives and escape from air-gapped systems.

Darktrace said it identified the new variant targeting its honeypot network last month, a deliberately misconfigured Hadoop instance that enables remote code execution on the service. In the attack spotted by the cybersecurity company, the intrusion commenced with an HTTP request to the Hadoop deployment to create a new application.

Chaos is a cross-platform malware that can run remote shell commands...

The application, for its part, embedded a sequence of shell commands to retrieve a Chaos agent binary from an attacker-controlled server ('pan.tenire[.]com'), set permissions to allow all users to read, modify, or run it ('chmod 777'), and then actually execute the binary and delete the artifact from disk to minimize the forensic trail.

One honeypot in that network runs Apache Hadoop, an open-source distributed data processing framework, deliberately misconfigured to allow remote code execution.

The malware establishes persistence using systemd and stores a keep-alive script on disk.

The malware establishes persistence using systemd and stores a keep-alive script on disk.

...runs the binary before deleting traces.

The second version of Chaos added advanced options for administrator privileges, the ability to delete all volume shadow copies and the backup catalog

This application then retrieves a Chaos agent binary from an attacker-controlled server, sets permissions to allow execution, and runs the binary...

Chaos is a cross-platform malware that can run remote shell commands, deploy additional modules, propagate via SSH brute-forcing...

The internal namespace was restructured and several functions were rewritten or removed, including the SSH brute-forcing spreader...

For example, it searched the following file paths and extensions to infect: Directories \Contacts \Desktop \Documents \Downloads ...

It also has the kind of tradecraft defenders should not shrug off: social engineering, remote-management abuse, payload retrieval, staging, and leaked data.

Chaos was first documented by Lumen Black Lotus Labs in September 2022, describing it as a cross-platform malware capable of targeting Windows and Linux environments to run remote shell commands, drop additional modules, propagate to other hosts by brute-forcing SSH keys

One of the more interesting functions of Chaos version 1.0 was its worming function, which allowed it to spread to all drives found on an affected system. This could permit the malware to jump onto removable drives and escape from air-gapped systems.

The command-and-control server is reached through an embedded domain, gmserver[.]osfc[.]org[.]cn, which at the time of analysis resolved to an IP address geolocated to Hong Kong.

The new 64-bit ELF binary has removed SSH propagation and router exploit functions, replacing them with a SOCKS proxy feature to ferry traffic and conceal malicious activity.

When the malware receives a StartProxy command from the command-and-control (C2) server, it will begin listening on an attacker-controlled TCP port and operates as a SOCKS5 proxy.

Taking their place is a new SOCKS proxy feature that allows the compromised system to be used for ferrying traffic, thereby concealing the true origins of malicious activity and making it harder for defenders to detect and block the attack.

It also has the kind of tradecraft defenders should not shrug off: social engineering, remote-management abuse, payload retrieval, staging, and leaked data.

Smyth Companies, LLC has failed to protect its infrastructure. We have successfully exfiltrated high...

We are announcing a major security breach and data exfiltration from Flad Architects...

Instead of encrypting files (which could then be decrypted after the target paid the ransom), it replaced the files’ contents with random bytes, after which the files were encoded in Base64. This meant that affected files could no longer be restored

With version 3.0, the Chaos ransomware builder gained the ability to encrypt files under 1 MB using AES/RSA encryption... The fourth iteration of Chaos expands the AES/RSA encryption by increasing the upper limit of files that can be encrypted to 2 MB.

The second version of Chaos added advanced options for administrator privileges, the ability to delete all volume shadow copies and the backup catalog, and the ability to disable Windows recovery mode.

In addition, it gives the ransomware builder’s users the ability to add their own extensions to affected files and the ability to change the desktop wallpaper of their victims.

Chaos is a cross-platform malware that can run remote shell commands, deploy additional modules, propagate via SSH brute-forcing, mine cryptocurrency...

Chaos is a cross-platform malware that can run remote shell commands, deploy additional modules, propagate via SSH brute-forcing, mine cryptocurrency, and launch DDoS attacks.