Loading story…
A new Rust-based backdoor known as ChaosBot has been identified targeting financial services organizations, with researchers first detecting the malware in late September 2025. ChaosBot is notable for its use of Discord channels as a covert command-and-control (C2) mechanism, allowing threat actors to issue remote commands and maintain persistent access to compromised systems. The malware campaign was discovered after attackers leveraged compromised credentials, including those mapped to Cisco VPN and an over-privileged Active Directory account, to gain initial access to a financial services network. Once inside, the attackers used Windows Management Instrumentation (WMI) to execute remote commands and deploy ChaosBot across multiple systems. Distribution of ChaosBot has also been observed via phishing emails containing malicious Windows shortcut (LNK) files, which, when opened, execute a PowerShell command to download and run the malware. To distract victims, the phishing campaign displays a decoy PDF purporting to be legitimate correspondence from the State Bank of Vietnam. The core payload is a malicious DLL named 'msedge_elf.dll', which is sideloaded using the Microsoft Edge binary 'identity_helper.exe' to evade detection. Upon execution, ChaosBot performs system reconnaissance and downloads a fast reverse proxy (FRP) tool to establish a reverse proxy, facilitating ongoing access to the victim network. The threat actors behind ChaosBot, operating under the Discord handle 'chaos_00019', have also attempted to configure Visual Studio Code Tunnel services as an additional backdoor, though these efforts were reportedly unsuccessful. The campaign demonstrates a sophisticated approach to persistence and lateral movement, combining credential abuse, living-off-the-land techniques, and novel C2 infrastructure. Security researchers have highlighted the risk posed by the abuse of legitimate collaboration platforms like Discord for malware control, which can bypass traditional network defenses. The use of Rust as the malware's programming language further complicates detection and analysis due to its cross-platform capabilities and relative novelty in the malware ecosystem. Financial services organizations are urged to review credential hygiene, monitor for unusual VPN and Active Directory activity, and scrutinize the use of Discord and other messaging platforms within their environments. The campaign underscores the ongoing evolution of malware delivery and C2 tactics, particularly in targeting high-value sectors such as finance.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Separate reporting described a C++-based Chaos ransomware variant called Chaos-C++ that adds destructive behavior by deleting contents of very large files instead of encrypting them and includes clipboard hijacking to swap Bitcoin addresses. Researchers also noted its fake-utility downloader, execution marker file, and recovery-inhibition behavior when run with administrator privileges.
Researchers published technical details on ChaosBot, including its DLL sideloading chain using msedge_elf.dll and identity_helper.exe, phishing delivery via malicious LNK files, FRP persistence, attempted VS Code Tunnel use, and newer variants with ETW bypass and VM evasion. The disclosure identified the malware as targeting financial services environments.
During the intrusion, the threat actor used WMI for remote command execution to deploy ChaosBot on Windows systems. The malware established command-and-control through Discord by creating victim-specific channels and supporting shell commands, screenshots, and file transfer.
eSentire reported detecting a new Rust-based backdoor dubbed ChaosBot in late September 2025 during an intrusion affecting a financial services organization. The attackers used compromised Cisco VPN credentials and an over-privileged Active Directory account to gain and expand access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that the Chaos ransomware group is using a new Rust-based remote access trojan, **msaRAT**, to conceal command-and-control traffic inside legitimate browser activity. Instead of making direct outbound connections, the malware launches a headless **Google Chrome** or **Microsoft Edge** instance with the **Chrome DevTools Protocol** enabled, injects JavaScript, and uses the browser to establish a **WebRTC DataChannel** for encrypted communications. Talos said the malware combines WebRTC **DTLS** with its own **ChaCha-Poly1305** encryption using an **ECDH**-derived shared key, giving operators covert tunneling, browser-assisted remote code execution, and asynchronous multi-threaded control. The reported intrusion chain begins with email or voice phishing, followed by the use of remote management software for persistence and delivery of an MSI installer disguised as a Windows update. That installer, identified as **`update_ms.msi`**, is downloaded over plain HTTP on port 443, extracts **`lib.dll`**, and loads it directly into memory before starting the browser in remote debugging mode. For signaling, the browser communicates with a **Cloudflare Workers** endpoint, while **Twilio TURN** infrastructure relays WebRTC traffic, a design that obscures attacker-controlled systems and makes network-based detection and attribution more difficult.
Jul 27, 2026
Zscaler ThreatLabz disclosed a new Rust-based backdoor dubbed **C2Looper** that it assesses is likely tied to a ransomware-related threat actor and used to establish footholds for lateral movement. Older samples beaconed every second over plaintext HTTP using JSON-formatted traffic and supported arbitrary shell execution, file download, and an update mechanism that abused OneDrive DLL sideloading through a malicious `wtsapi32.dll`. Researchers said the malware may be delivered through a multi-stage ClickFix infection chain, though that link is assessed with low to medium confidence. A newer internally labeled **version 2** moves command-and-control activity to **GitHub**, where beacon, tasking, and result data are stored in JSON files, and expands the malware's capabilities with directory listing, drive enumeration, host reconnaissance, and shellcode injection. ThreatLabz observed older C2Looper variants downloading the newer build through their upload functionality, indicating active development and iterative refinement, while the latest version also changes command handling and fixes a task ID parsing bug present in earlier releases.
Aug 18, 2026
Cybersecurity researchers have uncovered a coordinated campaign in which malicious packages distributed through popular open-source repositories—npm, PyPI, and RubyGems—are being used to exfiltrate sensitive developer data using Discord webhooks as a command-and-control (C2) channel. Attackers have published several packages, such as mysql-dumpdiscord and nodejs.discord on npm, as well as malinssx, malicus, and maliinn on PyPI, and sqlcommenter_rails on RubyGems, which are designed to steal configuration files, environment variables, and host information from developer systems. These packages leverage Discord webhooks, which allow data to be sent directly to attacker-controlled Discord channels without requiring authentication or bot users, making detection and mitigation more challenging. The use of Discord webhooks is particularly insidious because webhook URLs are write-only, preventing defenders from easily auditing what data has been exfiltrated. In some cases, the malicious code is triggered during package installation, such as with 'pip install' commands, enabling the theft of sensitive information before runtime monitoring can detect the activity. The stolen data includes critical files like config.json, .env, ayarlar.js, ayarlar.json, and even system files such as '/etc/passwd' and '/etc/resolv.conf', which may contain credentials, API keys, and other secrets. By abusing Discord’s infrastructure, attackers avoid the costs and risks associated with maintaining their own C2 servers, and their traffic often blends in with legitimate communications, bypassing many firewall and monitoring solutions. The campaign highlights the ongoing risks associated with software supply chain attacks, where threat actors target developers and CI/CD environments by injecting malicious code into widely used open-source packages. Security experts warn that such attacks can have far-reaching consequences, as compromised developer machines and build systems may inadvertently propagate stolen secrets or further malicious code into downstream applications. The discovery underscores the importance of rigorous package vetting, monitoring for suspicious network activity, and the use of security tools that can detect anomalous behavior during package installation. Researchers emphasize that the abuse of Discord webhooks for C2 is a growing trend, as it offers attackers a free, scalable, and stealthy method for data exfiltration. The incident serves as a reminder for organizations to review their dependency management practices and to educate developers about the risks of installing untrusted packages. The affected repositories have been notified, and some of the malicious packages have been removed, but the ease of publishing new packages means the threat remains ongoing. This campaign demonstrates the evolving tactics of threat actors in targeting the software supply chain and the need for continuous vigilance in the open-source ecosystem. Organizations are advised to implement automated scanning of dependencies and to restrict outbound network connections from build environments where possible. The use of Discord as a C2 channel is expected to persist, given its accessibility and the difficulty of monitoring webhook-based exfiltration. Security teams should update detection rules to flag unexpected communications with Discord domains, especially from development and CI/CD systems. The incident also highlights the broader challenge of securing open-source software, where trust in package maintainers and repositories is critical but increasingly under attack.
Jun 29, 2026