New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

A new variant of the Chaos botnet malware has been identified targeting misconfigured cloud deployments, with notable capability additions including a SOCKS proxy feature.

• •Chaos was first documented in September 2022 as cross-platform malware targeting Windows and Linux, capable of DDoS attacks, cryptomining, SSH brute-forcing, and remote shell execution.
• •The new variant was discovered targeting a deliberately misconfigured Hadoop instance, initiating attacks via HTTP requests to create malicious applications that download and execute a Chaos agent binary.
• •The attacker-controlled domain was previously linked to the Chinese cybercrime group Silver Fox and their ValleyRAT malware campaign (Operation Silk Lure, October 2025).
• •Key changes in this variant include removal of SSH propagation and router exploit functions, replaced by a SOCKS proxy feature that conceals malicious traffic origins.