[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1buBRcacrsho4aVvXzA1GdgF6IhBF-Ll1ZMQWh3lowQ":3},{"article":4,"iocs":51,"watch_terms":65,"solutions":66,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"5489a2f4-8021-47c7-88ef-aee8bf0447b6","New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy","new-chaos-variant-targets-misconfigured-cloud-deployments-adds-socks-proxy-446f36","Cybersecurity researchers have flagged a new variant ofmalware called Chaosthat'scapable of hitting misconfigured cloud deployments, marking an expansion of the botnet's targeting infrastructure. \"Chaos malware is increasingly targeting misconfigured cloud deployments, expanding beyond its traditional focus on routers and edge devices,\" Darktrace said in a new report.","Cybersecurity researchers have identified a new variant of Chaos malware that expands beyond traditional router\u002Fedge device targeting to focus on misconfigured cloud deployments, particularly Hadoop instances. The updated variant removes SSH and router exploitation functions in favor of a new SOCKS proxy feature, allowing attackers to route traffic through compromised systems for obfuscation and monetization beyond cryptocurrency mining and DDoS-for-hire services. The malware's origins suggest a Chinese threat actor, with infrastructure overlapping previous campaigns by the Silver Fox cybercrime group.","New Chaos malware variant targets misconfigured cloud deployments, adds SOCKS proxy capability.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fnew-chaos-variant-targets-misconfigured.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgjO6ntnqBUePhV2XQEQmTFh-IjdPR64u_T9ODhO3RY_BAv_8YohhRCwMg6OO9UKlvJJCd7rs1c391fbNZ59qDsSujaFJuso3h_94xKo2BX2L5Jj-osBqZ3VglM5kbgzt6OJGtkiNx4Am6NbgzrHtUa7fbdnfei8_xeJao4yvlMp3HkCurz9aNJkg9Xv934\u002Fs1600\u002Fcloud.jpg","2026-04-08T17:51:00+00:00","2026-04-08T20:00:32.212967+00:00",8,[17,20,22,25,28,30],{"name":18,"type":19},"Silver Fox","threat_actor",{"name":21,"type":19},"Chinese cybercrime group (suspected)",{"name":23,"type":24},"Operation Silk Lure","campaign",{"name":26,"type":27},"Darktrace","vendor",{"name":29,"type":27},"Lumen Black Lotus Labs",{"name":31,"type":32},"Hadoop","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":33,"icon":35,"name":36,"slug":37},null,"Malware","malware",[39,41,46],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,59,62],{"type":53,"value":54,"context":55},"domain","pan.tenire.com","Attacker-controlled C2 server hosting Chaos agent binary in cloud deployment attack",{"type":37,"value":57,"context":58},"Chaos","Cross-platform DDoS botnet malware targeting cloud and edge infrastructure",{"type":37,"value":60,"context":61},"Kaiji","Predecessor DDoS malware targeting misconfigured Docker instances; Chaos assessed as evolution",{"type":37,"value":63,"context":64},"ValleyRAT","Remote access trojan delivered via Silver Fox phishing campaign using pan.tenire.com infrastructure",[26,29],{"controls":67,"vendors":152},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":98,"name":99,"problem":100,"products":101},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"slug":127,"name":128,"problem":129,"products":130},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":148,"product_name":149,"url":150,"description":151},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[153],{"slug":154,"name":26,"logo_path":155,"roles":156},"darktrace","\u002Fvendor-logos\u002Fdarktrace.png",[157],"reported_by",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"chaos-malware-exploits-cloud-misconfigurations","Chaos Malware Exploits Cloud Misconfigurations","The new Chaos variant demonstrates how attackers are shifting focus from traditional network infrastructure to poorly configured cloud services, particularly targeting Hadoop deployments with weak security postures. By exploiting misconfigurations rather than zero-day vulnerabilities, attackers can establish persistent footholds in cloud environments and monetize access through SOCKS proxy services. This evolution highlights the critical importance of proper cloud security configuration and the growing threat landscape targeting cloud-native applications and services.",[163,164,165,166,167,168,169],"CIS Controls 1","CIS Controls 3","CIS Controls 12","NIST CM-2","NIST CM-6","NIST RA-5","ISO 27001 A.12.6.1",{}]