Loading story…
Researchers reported that a new Chaos malware variant was deployed through a misconfigured Apache Hadoop instance, where an attacker abused an application-creation endpoint to execute shell commands, download a 64-bit ELF payload from pan.tenire[.]com, run it, and then remove it from disk. The intrusion, observed in Darktrace’s CloudyPots honeypot environment, shows Chaos moving beyond its earlier focus on routers and into Linux cloud-server compromises.
The sample was identified as an evolved form of the Go-based Chaos malware previously described as a multi-purpose "Swiss army knife" threat. It retained DDoS and persistence functions while adding a SOCKS5 proxy capability and dropping some older spreading and exploitation features. Analysts said it established persistence with systemd, used a keep-alive script at /boot/system.pub, and relied on the embedded domain gmserver.osfc[.]org[.]cn for command-and-control resolution over port 65111, underscoring the risk posed by exposed or misconfigured cloud services.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
In March 2026, Darktrace observed a threat actor abuse a misconfigured Apache Hadoop instance in its CloudyPots honeypot to execute shell commands, download a Chaos binary, run it, and delete it. Darktrace assessed the payload as an evolved 64-bit ELF variant of Chaos targeting a Linux cloud-server environment.
Lumen’s Black Lotus Labs first discovered the Go-based Chaos malware family. Later reporting identifies this as the initial public discovery point for the malware.
Darktrace reported that the March 2026 sample retained DDoS and persistence features but dropped some earlier spreading and exploitation functions while adding a SOCKS5 proxy capability. The report also published technical details including persistence via systemd and /boot/system.pub, C2 domain gmserver.osfc[.]org[.]cn on port 65111, and related indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Darktrace reported a new **Chaos** malware variant compromising misconfigured Linux cloud servers after observing an intrusion through its CloudyPots honeypot network. In the incident, attackers abused an exposed Apache Hadoop application-creation or resource-manager endpoint to achieve remote command execution, then downloaded a 64-bit Linux ELF payload from `pan.tenire[.]com`, changed its permissions, executed it, and removed it from disk. The activity marks an expansion for the Go-based malware family, which had previously been associated mainly with routers, edge devices, DDoS operations, cryptomining, SSH brute-forcing, and exploitation of known vulnerabilities. The updated sample retained persistence and multi-protocol **DDoS** functionality while adding a **SOCKS5 proxy** capability that could relay attacker traffic and support internal network pivoting. Darktrace said some older spreading and exploitation features appear to have been removed, suggesting a shift toward proxy-enabled botnet operations rather than broader self-propagation. The malware used `gmserver.osfc[.]org[.]cn` to resolve command-and-control infrastructure and communicated over port `65111`; researchers also noted Chinese-language strings, `zh-CN` locale indicators, and infrastructure overlap with a ValleyRAT campaign, although they said any attribution to a Chinese threat actor remains circumstantial.
Jun 29, 2026
A Linux cloud cryptojacking campaign deployed the **CHAOS RAT** alongside an **XMRig** Monero miner, expanding a typical resource-theft intrusion into a broader remote-access compromise. The infection chain retained common miner tradecraft, including killing competing malware and resource-intensive processes, establishing persistence through `/etc/crontab`, and using Pastebin plus multiple hosting locations to fetch payloads. Researchers said the operators also separated payload delivery infrastructure from command-and-control, with the payload server appearing to be in Russia and the RAT C2 likely geolocated in Hong Kong. The Go-based CHAOS RAT gave attackers capabilities beyond mining, including reverse shell access, file transfer, screenshot capture, system reconnaissance, and host reboot or shutdown. The malware authenticated to its C2 with a hardcoded JSON Web Token supplied at compile time, illustrating a more structured command channel than is typical in basic cryptomining infections. The combination of persistence, miner deployment, and full-featured remote administration showed how Linux cloud-focused threats were evolving from opportunistic cryptojacking into multi-purpose post-compromise operations.
Aug 14, 2026
Attackers have been targeting **Oracle WebLogic** servers with a newly identified Linux malware dubbed **Hadooken**, using compromised access to install a cryptominer and the **Tsunami** DDoS botnet. Researchers observed the activity on a honeypot and found the initial intrusion relied on **weak credentials** rather than exploitation of a software flaw, after which the operators used shell and Python-based tooling to deploy malware, gain persistence through cron jobs, and erase logs to reduce visibility. Post-compromise activity showed the attackers searching for SSH data, attempting lateral movement, and expanding control across Linux environments. Analysis also linked Hadooken infrastructure and code overlaps to **RHOMBUS** and **NoEscape** ransomware families, while a PowerShell payload hosted on a related delivery server was seen downloading **Mallox** ransomware for Windows, indicating the campaign may combine immediate monetization through cryptomining and DDoS with follow-on ransomware operations against mixed Linux and Windows estates.
Aug 14, 2026