New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Key Points:

• A new variant of Chaos malware targets misconfigured cloud deployments, expanding its attack surface beyond routers and edge devices.
• The malware impacts both Windows and Linux environments, capable of executing remote shell commands, cryptocurrency mining, and launching DDoS attacks. It exploits misconfigured services like Hadoop to install itself.
• Organizations should immediately audit their cloud configurations, implement strict access controls, and monitor for unauthorized HTTP requests to mitigate risks associated with this evolving threat.

Technical Details: Chaos malware has been observed leveraging HTTP requests to exploit misconfigured Hadoop instances for remote code execution. The malware includes a SOCKS proxy feature to obscure malicious traffic origins.

MITRE ATT&CK Techniques:

• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - Exploit Public-Facing Application (Initial Access)
• T1059.001 - Command and Scripting Interpreter: PowerShell (Execution)

IOCs Mentioned:

• pan.tenire.com (domain)