New Rust-Based Malware "ChaosBot" Uses Discord Channels to Control Victims' PCs

ChaosBot is a Rust-based backdoor disclosed by cybersecurity researchers, capable of reconnaissance and remote command execution on compromised Windows hosts. According to eSentire, threat actors leveraged compromised credentials mapped to both Cisco VPN and an over-privileged Active Directory account named "serviceaccount" to use WMI for executing remote commands across systems and deploying ChaosBot.

The malware is notable for disguising its command-and-control channel through Discord, with a profile tied to the operator under the name "chaos_00019" and a second Discord account associated with C2 operations, lovebb0024. It also has a phishing delivery vector using a malicious Windows shortcut file, where opening the LNK triggers a PowerShell command to download ChaosBot while a decoy PDF pretends to be a State Bank of Vietnam document.

The payload is a malicious DLL named "msedge_elf.dll" sideloaded by identity_helper.exe, after which ChaosBot downloads a fast reverse proxy to maintain persistent access and can execute commands such as shell via PowerShell and capture screenshots. The disclosure notes that variants employ evasion techniques against ETW and VM checks to avoid analysis.