New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
Darktrace says the Chaos botnet now targets misconfigured cloud deployments like Hadoop and added a SOCKS proxy for traffic relaying.
Darktrace identified a new 64-bit ELF variant of the Chaos botnet targeting misconfigured cloud deployments, expanding beyond the malware's traditional focus on routers and edge devices. Captured in a deliberately misconfigured Hadoop honeypot instance, the intrusion began with an HTTP request creating an application that ran embedded shell commands to fetch the Chaos agent binary from pan.tenire[.]com, set chmod 777 permissions, execute it, and delete the artifact to reduce forensic traces. The restructured variant adds a SOCKS proxy feature letting compromised systems ferry attacker traffic, while removing SSH-based spread and router-exploit functions, suggesting monetization beyond crypto mining and DDoS-for-hire. Possible Chinese origin is suggested by language artifacts and infrastructure; the delivery domain was previously used in Silver Fox's Operation Silk Lure phishing campaign delivering ValleyRAT.
- New variant hit a deliberately misconfigured Hadoop honeypot enabling remote code execution.
- Added a SOCKS proxy feature to monetize the botnet beyond crypto mining and DDoS-for-hire.
- Removed SSH spread and router-exploit functions from the restructured 64-bit ELF binary.
- Attack used chmod 777, binary execution, and artifact deletion to minimize forensic trails.
- Delivery domain previously linked to Silver Fox's Operation Silk Lure, which spread ValleyRAT.
- Vendors
- Darktrace
- Products
- Hadoop
- Threat actors
- Silver Fox
- Organizations
- Lumen Black Lotus Labs
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | tenire.com | Chaos agent binary from an attacker-controlled server ("pan.tenire[.]com"), set permissions to allow all users to read, modify, or |
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Apr 08, 2026 Cryptomining / Network Security Cybersecurity researchers have flagged a new variant of malware called Chaos that's capable of hitting misconfigured cloud deployments, marking an expansion of the botnet's targeting infrastructure.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.