Chaosbot Using CiscoVPN and Active Directory Passwords for Network Commands

According to eSentire’s Threat Response Unit (TRU), suspicious activity was observed when legitimate CiscoVPN logins coincided with anomalous WMI calls to multiple endpoints in a financial services environment, with an Active Directory account named “serviceaccount” abused alongside VPN access to grant broad execution privileges.

In late September 2025, TRU identified a novel Rust-based backdoor dubbed “ChaosBot” that used compromised CiscoVPN credentials and an over-privileged Active Directory account to move laterally, execute remote commands and maintain persistence via Discord-powered command and control.

The payload, msedge_elf.dll, was side-loaded through Microsoft Edge identity_helper.exe from C:\\Users\\Public\\Libraries, enabling ChaosBot to deploy undetected, retrieve system information, and establish an inbound tunnel via a fast reverse proxy (frp).

Analysis notes the malware connects to Discord using a bot token embedded in its configuration, creates a channel named after the victim hostname, and polls that channel for commands to execute locally via PowerShell, including commands to retrieve system information and capture screenshots.

The report also identifies two Discord user accounts—chaos_00019 and lovebb0024—behind the C2 infrastructure, with metadata suggesting account creation in mid-2024, and highlights evasive techniques such as disabling telemetry and VM checks.