New Variants of Chaos RAT Attacking Windows and Linux Systems to Steal Sensitive Data

Cybersecurity researchers have identified sophisticated new variants of Chaos RAT, a remote administration tool that has evolved from an open-source project into a formidable cross-platform malware threat targeting both Windows and Linux systems.

Originally documented in 2022, this malware has undergone significant development, transforming into a versatile weapon capable of comprehensive system compromise and data exfiltration.

The malware deploys through carefully crafted phishing campaigns, utilizing malicious PDF attachments that initiate multi-stage infection chains.

These documents exploit user interaction by prompting victims to click embedded links, triggering the download of platform-specific payloads that establish persistent control over infected devices.

PolySwarm analysts identified that Chaos RAT’s technical sophistication extends beyond simple data theft, incorporating cryptocurrency mining capabilities that generate illicit profits while degrading system performance.

Written primarily in C++, the malware demonstrates remarkable adaptability across operating systems, with Windows infections beginning through JavaScript files that fetch ZIP archives containing BAT scripts, while Linux variants masquerade as legitimate network diagnostic tools like “NetworkCheck”.

The attack’s impact encompasses comprehensive device control, including keylogging, screen capture, file exfiltration, and remote command execution capabilities.

Advanced Evasion and Persistence Mechanisms

Chaos RAT employs sophisticated anti-analysis techniques that significantly complicate detection and remediation efforts.

The malware implements complex obfuscation strategies, including encoded strings and dynamic API resolution, specifically designed to hinder reverse engineering attempts.

Environmental awareness represents a critical component of its evasion arsenal, as the malware conducts pre-execution checks to detect virtualized environments and sandbox systems, ensuring execution only occurs in favorable conditions.

The persistence mechanism varies by platform, with Windows systems experiencing scheduled task creation and registry modifications that maintain the malware’s presence across system reboots.

Linux deployments utilize shell scripts with obfuscated URLs and encrypted payloads, effectively bypassing traditional security controls through sophisticated encoding techniques.

Automate threat response with ANY.RUN’s TI Feeds—Enrich alerts and block malicious IPs across all endpoints -> Request full access