Cybersecurity researchers have identified sophisticated new variants of the Chaos RAT, a remote administration tool that started as an open source project and has now turned into a serious threat , targeting both Windows and Linux systems.
See also: Fake DocuSign pages distribute NetSupport RAT malware
Initially recorded in 2022, this malware has undergone significant evolution, transforming into a versatile “weapon”, capable of achieving full system compromise and data extraction . It is distributed through targeted phishing campaigns, using malicious PDF attachments that initiate multi-stage infection chains.
These documents rely on user interaction, inducing victims to click on embedded links, which lead to the download of malware payloads, specifically tailored to the respective platform, establishing permanent control over the infected devices.
PolySwarm analysts found that the technical sophistication of Chaos RAT goes beyond simple data theft, incorporating cryptocurrency mining capabilities, which generate illicit profits while also severely burdening system performance
See also: Malware analysis reveals sophisticated RAT
The malware, which is written primarily in C++, demonstrates impressive adaptability to various operating systems. On Windows, the infection begins with JavaScript files that download compressed ZIP files containing BAT scripts. Similarly, on Linux versions, the malware disguises itself as legitimate network diagnostic tools, such as “NetworkCheck.”
The implications of the attack are far-reaching, including complete control of the device, with capabilities such as keylogging, screenshots, file extraction , and remote command execution.
Chaos RAT uses sophisticated anti-analysis techniques that significantly complicate detection and remediation efforts.
See also: Bitdefender antivirus: Fake site distributes Venom RAT
Based on the above, it is clear that Chaos RAT is a particularly dangerous and sophisticated malware, which combines social engineering techniques with complex attack tactics to gain complete control over Windows and Linux systems. The fact that it also integrates cryptocurrency mining shows that the attackers are not limited to spying or data theft, but also seek to economically exploit the victims' computing resources.
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
