Chaos RAT Evolves To Target Both Linux And Windows, Stealing Sensitive Data

Cybersecurity experts have recently identified a surge in attacks leveraging new, advanced variants of the open-source remote administration tool known as Chaos RAT.

Originally crafted as a legitimate remote management utility, Chaos RAT has been increasingly hijacked by cybercriminals to target Linux and Windows systems.

Written in Golang, its cross-platform compatibility and ease of customization make it particularly attractive for malicious operators.

The latest variants not only enhance the attacker’s toolkit but also present an ironic twist, as vulnerabilities in the malware itself can potentially be exploited, highlighting the double-edged nature of open-source security tools.

Infection Techniques And Core Functionality

Attackers are disguising the Linux version of Chaos RAT as harmless software packages such as NetworkAnalyzer.tar.gz to trick users into downloading and executing them.

Once a user unknowingly runs the malicious binary, the malware ensures it remains active by modifying the system’s crontab file, a core job scheduler on Linux platforms.

A typical malicious cron job added might appear as follows:

• This line directs the system to retrieve and execute a remote payload at regular intervals, ensuring the attacker’s code persists even after reboots.
• The payload itself is highly modular.
• Each Chaos RAT binary contains an embedded configuration, encoded in Base64 and featuring randomized field names to hinder detection and analysis.

Upon decoding, this configuration reveals critical infrastructure: the command and control (C2) server address, port number, and a JWT authentication token required for communications.

When executed, the RAT immediately scans the infected host, gathering details such as hostname, operating system specifics, MAC address, and IP address.

Notably, the malware’s logic branches according to the detected platform, enabling system-specific command implementations.

Chaos RAT establishes a heartbeat with its C2 server, polling for new instructions roughly every 30 seconds.

If the server is inaccessible, it continues attempting indefinitely.

The command protocol is JSON-based and includes a comprehensive set of remote administration features.

These range from system information gathering, file management, and directory exploration to more invasive operations such as screenshot capture.

The malware can receive and execute restart or shutdown commands (using platform-appropriate system utilities), illicitly enumerate or transfer files, and even open arbitrary URLs using the default system browser.

For any unrecognized instruction, Chaos RAT simply hands the input to the operating system shell and returns the base64-encoded output to the C2 server, offering attackers nearly unlimited remote control.

A particularly telling example of its sophistication is the file download functionality, implemented in Golang.

The malware can read a specified file, encode its contents, and upload it to the attacker’s server, using the JWT token for authentication and HTTP POST requests to transmit the data.

This capability adds significant risk for sensitive data exfiltration.

Vulnerabilities And Security Implications

According to TRU Security, Ironically, even as Chaos RAT empowers attackers, recent research has identified critical weaknesses in its own administration backend.

The first is a command injection vulnerability in the function used to build custom infection clients.

Because this function constructs shell commands from user-provided data such as server addresses or filenames, attackers with admin access can supply crafted input that gets executed on the server.

Secondly, a cross-site scripting issue in the web-based admin panel allows the injection of malicious JavaScript payloads, which executes in the browser of any administrator viewing compromised agent data.

Both flaws demonstrate that even tools created for offensive security or criminal activity are not immune to the same coding oversights that plague legitimate software.

The open-source nature of Chaos RAT means that anyone can access, modify, and distribute its codebase.

While this has accelerated its adoption by criminal groups, it also enables defenders and researchers to analyze and construct countermeasures rapidly.

Security products such as EDR and XDR platforms, including recent releases with enhanced behavior-based detection for Linux, are now able to reliably identify and quarantine Chaos RAT activity.

The emergence of Chaos RAT’s advanced variants underscores a broader trend in cyber threats: legitimate tools, when open-sourced, can quickly evolve into potent multipurpose weapons.

Both defenders and attackers must recognize that security flaws can exist anywhere, turning the tools of intrusion into points of vulnerability themselves.