New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy
New Chaos malware variant targets misconfigured cloud deployments, adds SOCKS proxy capability.
Cybersecurity researchers have identified a new variant of Chaos malware that expands beyond traditional router/edge device targeting to focus on misconfigured cloud deployments, particularly Hadoop instances. The updated variant removes SSH and router exploitation functions in favor of a new SOCKS proxy feature, allowing attackers to route traffic through compromised systems for obfuscation and monetization beyond cryptocurrency mining and DDoS-for-hire services. The malware's origins suggest a Chinese threat actor, with infrastructure overlapping previous campaigns by the Silver Fox cybercrime group.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Darktrace?
Get an email when a new story names Darktrace, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe new Chaos variant demonstrates how attackers are shifting focus from traditional network infrastructure to poorly configured cloud services, particularly targeting Hadoop deployments with weak security postures. By exploiting misconfigurations rather than zero-day vulnerabilities, attackers can establish persistent footholds in cloud environments and monetize access through SOCKS proxy services. This evolution highlights the critical importance of proper cloud security configuration and the growing threat landscape targeting cloud-native applications and services.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — pan.tenire.com
- malware — Chaos
- malware — Kaiji
- malware — ValleyRAT