New Chaos RAT Variants Exploiting Windows and Linux Systems to Exfiltrate Sensitive Data

New variants of the infamous Chaos RAT, originally launched as an open-source remote administration toolkit in 2022, have been uncovered in a campaign targeting both Windows and Linux systems.

The evolution from an open-source utility into a sophisticated cross-platform malware has drawn significant attention from security researchers, notably the Acronis Threat Research Unit and analysts at PolySwarm.

These new iterations leverage advanced infection chains, obfuscation techniques, and anti-analysis measures that make them a formidable threat to organizations and individual users alike.

Multi-Platform Capabilities

Chaos RAT’s latest campaign centers on extensive phishing efforts. Attackers distribute convincing phishing emails that entice recipients to open malicious PDF attachments.

Once interacted with, these attachments prompt users to follow embedded links triggering a multi-stage malware delivery process.

Windows users are first exposed to a malicious JavaScript file, which retrieves a compressed ZIP file with an embedded BAT script.

This script then downloads and executes the final Chaos RAT payload, stealthily establishing persistence via scheduled tasks and strategic registry alterations.

On Linux systems, adversaries disguise the malware as legitimate network diagnostic tools such as “NetworkCheck” misleading users and security controls alike.

Here, shell scripts are used to fetch and activate the RAT client, with the entire process shrouded in obfuscated URLs and encrypted payloads to bypass conventional detection measures.

Persistent Threats

The technical prowess of Chaos RAT is evident in its layered delivery mechanisms and its arsenal of anti-analysis features.

Researchers observe heavy use of string encoding, dynamic API resolution, and virtualization detection.

These techniques severely complicate reverse engineering efforts and enable the malware to execute only in suitable, non-sandboxed environments.

Once established, Chaos RAT grants attackers a potent blend of capabilities: keylogging, remote shell access, screen capture, data exfiltration, and the deployment of cryptomining software.

Not only does this enable direct theft of sensitive information, but it also turns compromised machines into revenue sources for criminals through illicit cryptocurrency mining.

This new wave of Chaos RAT does not appear to focus on any specific industry or geographic location, underscoring its broad appeal and versatility as a commodity malware.

The dual targeting of Windows and Linux environments significantly broadens the potential attack surface, threatening organizations with heterogeneous infrastructure and individuals across multiple platforms.

According to the Report, The open-source origin of Chaos RAT has fostered an environment where threat actors can quickly iterate and enhance the malware, adding new features and refining evasion tactics almost as quickly as defenses can adapt.

Security experts highlight the persistent nature of the threat: Chaos RAT’s multi-platform functionality, rapid evolution, and integration of robust anti-detection measures make it a continuing hazard in the cybersecurity landscape.

As phishing continues to be an effective delivery vector, user education and advanced email scanning remain critical.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates