New Rust Malware "ChaosBot" Uses Discord for Command and Control
Picus Security has identified "ChaosBot," a new malware written in Rust, that leverages the Discord platform for stealthy command and control operations, making it harder for security solutions to detect.
Cybersecurity firm Picus Security has uncovered a new malware strain named ChaosBot, developed in the Rust programming language. This threat utilizes the Discord platform to conceal its command and control (C2) traffic behind a legitimate service, making it more difficult for security systems to detect malicious activity.
ChaosBot validates its credentials with the Discord API and subsequently creates a private text channel named after the victim's machine. Attackers then send commands, such as file download requests or screenshot captures, directly into this channel. The compromised machine sends the results back as attached files. The malware also incorporates advanced anti-analysis techniques, including patching Windows ETW functions and checking for virtual machine MAC addresses.
Picus Security's report details ChaosBot's infection chain and its Discord-based C2 protocol. The threat is distributed by exploiting compromised CiscoVPN and Active Directory credentials, or through phishing campaigns using malicious Windows shortcut files disguised as communications from Vietnam's State Bank. The shortcut activates a PowerShell command that downloads and executes the malware while simultaneously opening a decoy PDF document.
ChaosBot is written in Rust and uses either the reqwest or serenity library for API interactions. The malware's configuration includes a Discord bot token, a Guild ID, and a Channel ID. This discovery highlights how attackers are continuously developing novel and more sophisticated methods to hide malicious operations by leveraging popular communication services.