New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Summary: Darktrace reported a new Chaos malware variant that targets misconfigured cloud deployments, expanding the botnet beyond its earlier focus on routers and edge devices. In an attack on a deliberately misconfigured Hadoop honeypot last month, the intrusion used an HTTP request to create an application that ran shell commands to pull a 64-bit ELF binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact from disk.
Bottom line: The variant drops Chaos's SSH-spreading and router-exploit functions and adds a SOCKS proxy, turning compromised hosts into traffic relays that conceal the origin of malicious activity - and the same domain was previously used by the Chinese cybercrime group Silver Fox in its Operation Silk Lure phishing campaign.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026