New Rust Backdoor ChaosBot Uses Discord as Covert C2 Channel to Target Financial Services

The eSentire Threat Response Unit (TRU) identified a new Rust-based backdoor named ChaosBot deployed inside a financial services organisation’s environment, using Discord as a covert full C2 channel. According to eSentire, the malware’s operators hide behind Discord bots, with chaos_00019 and lovebb0024 serving as two accounts directly involved in issuing commands across newly created host channels.

The attackers used compromised credentials, including a CiscoVPN login and an over-privileged Active Directory account named serviceaccount, to deploy ChaosBot via Windows Management Instrumentation, and the payload msedge_elf.dll was sideloaded through the legitimate identity_helper.exe component.

ChaosBot installs Fast Reverse Proxy to establish a persistent reverse connection, and researchers noted attempts to use Visual Studio Code’s Tunnel Service as an additional backdoor; the operators also ran phishing campaigns delivering PowerShell to download and run ChaosBot alongside a decoy PDF from the State Bank of Vietnam.

The malware connects to Discord using hardcoded bot tokens and creates channels named after infected hosts, where commands can be executed and data such as screenshots, files and outputs can be exchanged, with two Discord accounts created in 2024—chaos_00019 (Created: 7 June 2024) and lovebb0024 (Created: 9 May 2024).