Chaos RAT is an open-source project so attackers can modify and add features. It can execute reverse shells, upload and download files, delete files, take screenshots, access File Explorer, get os info, restart or shut down the system, and open URLs. All these features give attackers full control over compromised machines.

Distribution

In attacks we have seen, Chaos RAT is distributed through malicious scripts that modify the /etc/crontab file on Linux systems to make persistence by downloading the malware every 10 minutes from Pastebin. Additional payloads like XMRig miner and competition-killer scripts are also downloaded to maximize resource usage for cryptocurrency mining.

Evolution and Impact

First seen in November 2022, Chaos RAT has been used in more complex attacks against Linux systems. A RAT in cryptocurrency mining operations is an evolution of attack methods, allowing threat actors to have prolonged access to compromised machines and potentially expand their malicious activities beyond mining.