Cybersecurity researchers have released details of a new Rust-based backdoor called ChaosBot that can allow operators to conduct reconnaissance and execute arbitrary commands on infected computers.
According to a technical study released last week by eSentire, threat actors used compromised credentials that linked to both a Cisco VPN and an overprivileged Active Directory account called “serviceaccount.” They used WMI to run remote commands across network systems using the hacked account, which made it easier to deploy and run ChaosBot.
According to the Canadian cybersecurity firm, the virus was initially discovered in the environment of a financial services client in late September 2025.
The misuse of Discord for command-and-control (C2) by ChaosBot is notable. The online persona “chaos_00019” is used by the threat actor behind it to issue remote orders to the compromised devices read more about New Rust-Based Malware “ChaosBot” Uses Discord Channels to Control Victims’ PCs.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.