Chaos Botnet Variant: Cloud Misconfiguration Exploitation & SOCKS Proxy Detection

---
title: Chaos Botnet - Linux Binary Execution from Temp Directories
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects execution of binaries from common temporary directories, a tactic heavily used by Chaos malware to evade persistence mechanisms and detection.
references:
  - https://thehackernews.com/2026/04/new-chaos-variant-targets-misconfigured.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  filter_legit:
    Image|contains:
      - '/bin/'
      - '/usr/bin/'
      - '/sbin/'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate developer tools installing packages to temp
level: high
---
title: Linux SOCKS Proxy - Non-Standard Process Listening on High Port
id: b2c3d4e5-6789-01ab-cdef-234567890bcd
status: experimental
description: Detects processes with names commonly associated with Chaos or Kaiten malware listening on non-standard high ports, indicative of SOCKS proxying activity.
references:
  - https://thehackernews.com/2026/04/new-chaos-variant-targets-misconfigured.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection_img:
    Image|endswith:
      - 'chaos'
      - 'kaiten'
      - '.sh'
  selection_port:
    DestinationPort|range: 10000-65535
  condition: all of selection_*
falsepositives:
  - Legitimate custom applications using high ports
level: high

DeviceProcessEvents
| where Timestamp > ago(7d)
| where DeviceOSType == "Linux"
| where FolderPath has_any ("/tmp", "/dev/shm", "/var/tmp")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, SHA256
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemotePort >= 1024
    | project Timestamp, DeviceId, RemoteUrl, RemotePort, LocalPort
) on DeviceId, $left.Timestamp >= $right.Timestamp - 1m, $left.Timestamp <= $right.Timestamp + 1m
| summarize Count=count() by DeviceName, ProcessCommandLine, RemotePort, SHA256
| where Count > 5
| order by Count desc

-- Hunt for Chaos Botnet Indicators
SELECT 
  Pid,
  Name,
  Exe,
  Username,
  Ctime,
  CommandLine
FROM pslist()
WHERE Exe =~ '/tmp/' 
   OR Exe =~ '/dev/shm/' 
   OR Exe =~ '/var/tmp/'

-- Correlate with listening sockets (SOCKS Proxy detection)
SELECT 
  P.Pid,
  P.Name,
  P.Exe,
  L.Address,
  L.Port,
  L.State
FROM pslist() AS P
LEFT JOIN listen_sockets() AS L ON P.Pid = L.Pid
WHERE L.Port >= 10000 
   AND (P.Name =~ 'chaos' 
        OR P.Name =~ 'kaiten' 
        OR P.Exe =~ '/tmp/')

#!/bin/bash

echo "[*] Starting Chaos Malware Remediation Script"

echo "[+] Hunting for suspicious processes in /tmp, /dev/shm, /var/tmp"
PIDS=$(pgrep -f "\-\-update\-server" || true)
if [ -n "$PIDS" ]; then
  echo "[!] Found potential Chaos processes: $PIDS"
  kill -9 $PIDS
  echo "[+] Processes terminated."
else
  echo "[-] No common Chaos processes found running."
fi

echo "[+] Scanning for known Chaos/Kaiten binary locations..."
find /tmp -type f -name "chaos" -exec rm -f {} \;
find /dev/shm -type f -name "chaos" -exec rm -f {} \;
find /var/tmp -type f -name "chaos" -exec rm -f {} \;
find /tmp -type f -name ".kaiten" -exec rm -f {} \;
find /dev/shm -type f -name ".kaiten" -exec rm -f {} \;

echo "[+] Checking for persistence in cron..."
crontab -l | grep -v "chaos" | grep -v "kaiten" | crontab -

echo "[+] Checking systemd services for suspicious entries..."
systemctl list-units --type=service --state=running | grep -E "chaos|kaiten"

echo "[*] Remediation complete. Please review SSH access logs and rotate credentials."