Chaosbot Using CiscoVPN and Active Directory Passwords for Network Commands
Adversaries have demonstrated that operational hours are not a constraint for executing sophisticated cyberattacks. eSentire’s Threat Response Unit (TRU) identified suspicious activity within a financial services customer’s environment. This was…
Adversaries have demonstrated that operational hours are not a constraint for executing sophisticated cyberattacks. eSentire’s Threat Response Unit (TRU) identified suspicious activity within a financial services customer’s environment. This was characterized by legitimate CiscoVPN logins coinciding with anomalous WMI calls to multiple endpoints.
Further investigation revealed that an Active Directory account named "serviceaccount" had been exploited alongside the VPN access, granting attackers broad execution privileges.
In late September 2025, eSentire’s TRU identified a novel Rust-based backdoor dubbed “ChaosBot.” This malware exploited compromised CiscoVPN credentials and an over-privileged Active Directory account to move laterally, execute remote commands, and maintain persistence through Discord-powered command and control. The payload, msedge_elf.dll , was side-loaded via Microsoft Edge’s identity_helper.exe from C:\Users\Public\Libraries , enabling undetected deployment.
Initial reconnaissance commands retrieved system information, and a fast reverse proxy (frp) executable was downloaded to establish an inbound tunnel.
ChaosBot’s attack chain begins with credential theft through either brute forcing CiscoVPN logins or phishing campaigns delivering malicious Windows Shortcut (.lnk) files. The malware connects to Discord using a bot token embedded in its configuration, validates the token, and creates a new channel named after the victim’s hostname.
Adversaries have demonstrated that operational hours are not a constraint for executing sophisticated cyberattacks.
Supported commands allow execution of arbitrary shell commands, file download and upload, screenshot capture, and reverse proxy setup. For instance, “shell systeminfo” collects system details, while “scr” captures the desktop.
Evasion techniques include patching ntdll!EtwEventWrite to disable Event Tracing for Windows telemetry and checking MAC addresses against known VMware and VirtualBox prefixes to avoid execution in virtual machines.
eSentire’s SOC analysts isolated affected hosts and collaborated with the customer to eradicate the threat. Organizations are advised to enforce least privilege for remote access accounts, mandate multi-factor authentication on all VPN and domain logins, and enforce strong password policies.
Additional recommendations include maintaining current security patches, enabling detailed logging of authentication events, and actively monitoring for anomalous remote execution activity. Deploying a Next-Gen Antivirus or Endpoint Detection and Response solution can detect memory patching and abnormal PowerShell behavior.
For comprehensive protection, partnering with a 24/7 Managed Detection and Response provider ensures continuous threat hunting, rapid containment, and proactive threat intelligence. By adopting these measures, organizations can minimize the impact of sophisticated backdoors such as ChaosBot and stay ahead of adversaries.
Based on reporting by GBHackers.