Loading story…
Darktrace reported a new Chaos malware variant compromising misconfigured Linux cloud servers after observing an intrusion through its CloudyPots honeypot network. In the incident, attackers abused an exposed Apache Hadoop application-creation or resource-manager endpoint to achieve remote command execution, then downloaded a 64-bit Linux ELF payload from pan.tenire[.]com, changed its permissions, executed it, and removed it from disk. The activity marks an expansion for the Go-based malware family, which had previously been associated mainly with routers, edge devices, DDoS operations, cryptomining, SSH brute-forcing, and exploitation of known vulnerabilities.
The updated sample retained persistence and multi-protocol DDoS functionality while adding a SOCKS5 proxy capability that could relay attacker traffic and support internal network pivoting. Darktrace said some older spreading and exploitation features appear to have been removed, suggesting a shift toward proxy-enabled botnet operations rather than broader self-propagation. The malware used gmserver.osfc[.]org[.]cn to resolve command-and-control infrastructure and communicated over port 65111; researchers also noted Chinese-language strings, zh-CN locale indicators, and infrastructure overlap with a ValleyRAT campaign, although they said any attribution to a Chinese threat actor remains circumstantial.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage said researchers observed Chinese-language strings, zh-CN locale indicators, and infrastructure overlap with a ValleyRAT distribution campaign, suggesting possible Chinese origin. The reporting emphasized that this attribution remained circumstantial.
Darktrace publicly reported the March 2026 intrusion and said the malware communicated via infrastructure resolved through gmserver.osfc[.]org[.]cn over port 65111. The company highlighted the broader risk of botnets shifting toward proxy services and cloud misconfiguration abuse.
Analysis of the March 2026 sample showed a substantially updated 64-bit Linux ELF variant of the Go-based Chaos malware. The sample retained persistence and DDoS functions, dropped some older spreading and exploitation features, and added a SOCKS5 proxy capability for traffic relaying and internal pivoting.
In March 2026, Darktrace's CloudyPots honeypot captured an intrusion in which attackers abused a misconfigured Apache Hadoop application/resource manager endpoint to execute shell commands on a Linux cloud server. The attacker downloaded a Chaos malware binary from pan.tenire[.]com, ran it, and deleted it from disk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcehelpnetsecurity.com
Open sourcedarktrace.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Sophos reported that the **Chalubo** botnet is infecting exposed Linux servers and IoT devices and repurposing them for distributed denial-of-service operations. The malware was observed targeting internet-facing systems, using compromised devices as part of a broader botnet capable of launching disruptive traffic floods against downstream victims. The activity highlights continued risk from poorly secured embedded devices and servers that can be silently enrolled into attack infrastructure. By abusing both enterprise and consumer-connected systems, Chalubo expands the pool of available bots and increases the scale and resilience of DDoS campaigns launched from compromised hosts.
Jul 12, 2026