New Rust Malware “ChaosBot” Hides Command-and-Control Inside Discord

A new Rust-based malware dubbed ChaosBot has been exposed for using Discord as its command-and-control channel, making detection harder for traditional security tools. According to GBHackers On Security, ChaosBot validates its credentials with the Discord API and creates a private text channel named after the victim’s computer to serve as a covert shell for commands such as shell, download, and scr, with results exfiltrated back as attachments.

The threat leverages anti-analysis techniques including patching ETW and checking for VM MAC addresses to avoid security researchers, and it communicates via a Discord bot token, guild ID and channel ID to integrate with legitimate infrastructure. The initial intrusion used compromised credentials for CiscoVPN and a privileged Active Directory account called “serviceaccount,” with WMI for remote command execution and a payload disguised as msedge_elf.dll loaded via DLL sideloading.

Phishing campaigns using malicious .lnk files and a deceitful Vietnam central bank decoy PDF also feature in its delivery, while operators establish persistence with frp and experiment with Visual Studio Code Tunnel for backdoor access. To defend against this, the piece urges MFA for external and privileged accounts, monitoring for unusual Discord API traffic, application whitelisting, and ongoing phishing awareness and memory-patching detection. 22 October 2025.