{"id":9419,"date":"2026-04-08T21:35:46","date_gmt":"2026-04-09T01:35:46","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=9419"},"modified":"2026-04-08T20:53:52","modified_gmt":"2026-04-09T00:53:52","slug":"chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/","title":{"rendered":"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Routers were supposed to be the problem. For years, the Chaos botnet built its footprint across consumer and enterprise networking hardware, grinding through ARM and MIPS devices the way most botnets do. Then March 2026 arrived and researchers watching a deliberately vulnerable Apache Hadoop server saw something different show up at the door.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><a href=\"https:\/\/www.darktrace.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Darktrace<\/a> captured the new variant through <a href=\"https:\/\/www.darktrace.com\/blog\/darktrace-identifies-new-chaos-malware-variant-exploiting-misconfigurations-in-the-cloud\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">CloudyPots<\/a>, the company&#8217;s global honeypot network. One of those honeypots runs Hadoop with its resource manager endpoint intentionally left open to remote code execution. That specific misconfiguration, where the resource manager accepts unauthenticated application submissions from the internet, is a known risk that real organizations have left exposed in production environments. The honeypot exists precisely because attackers find it.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The intrusion followed a sequence that moved quickly. An HTTP request arrived at the resource manager, defined a new application, embedded shell commands, and pulled a Chaos binary from an external server. The binary ran. Then it deleted itself from disk. That last step is not accidental. Removing the file after execution leaves investigators with process artifacts and network logs rather than the binary itself, which complicates analysis significantly.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The sample is a 64-bit ELF binary built for x86-64 Linux, which is a different architecture entirely from the ARM and MIPS targets that defined earlier Chaos variants. The internal structure changed too, with several functions rewritten and others removed, including the SSH brute-forcing routines inherited from Kaiji, the botnet Chaos appears to have grown out of.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">What remained is what matters operationally: persistence through systemd, a keep-alive script, and DDoS capability across HTTP, TLS, TCP, UDP, and WebSocket. What arrived new is a SOCKS5 proxy function. When the control server sends a StartProxy command, the malware starts listening on an attacker-specified port and routes traffic through the compromised machine. <a href=\"https:\/\/hostingdiscussion.com\/news\/cyber-warfare-ai-threats-the-future-of-security-jonathan-shaws-expert-insights\/\">Attacks<\/a> that originate from the attacker appear to come from the victim&#8217;s connection instead. Internal networks accessible from the compromised host become reachable too.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Nathaniel Bill at Darktrace noted that another botnet, Aisuru, had already started selling proxy access as a revenue stream. Chaos adding the same capability suggests operators across the botnet economy are treating proxy services as a parallel business alongside DDoS-for-hire, not a bonus feature.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The delivery infrastructure connected to a domain previously linked to ValleyRAT distribution, and Chinese-language strings run throughout the binary.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Routers were supposed to be the problem. For years, the Chaos botnet built its footprint across consumer and enterprise networking hardware, grinding through ARM and MIPS devices the way most botnets do. Then March 2026 arrived and researchers watching a deliberately vulnerable Apache Hadoop server saw something different show up at the door. Darktrace captured [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[6274,1785,3814,6275,1376,954,728],"class_list":["post-9419","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-chaos-botnet","tag-cloud-security","tag-cybercrime","tag-darktrace-cloudypots","tag-ddos","tag-linux","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Routers were supposed to be the problem. For years, the Chaos botnet built its footprint across consumer and enterprise networking hardware, grinding through ARM and MIPS devices the way most botnets do. Then March 2026 arrived and researchers watching a deliberately vulnerable Apache Hadoop server saw something different show up at the door. Darktrace captured [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-09T01:35:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-09T00:53:52+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/\",\"name\":\"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-04-09T01:35:46+00:00\",\"dateModified\":\"2026-04-09T00:53:52+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/","og_locale":"en_US","og_type":"article","og_title":"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers - Web Hosting News","og_description":"Routers were supposed to be the problem. For years, the Chaos botnet built its footprint across consumer and enterprise networking hardware, grinding through ARM and MIPS devices the way most botnets do. Then March 2026 arrived and researchers watching a deliberately vulnerable Apache Hadoop server saw something different show up at the door. Darktrace captured [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/","og_site_name":"Web Hosting News","article_published_time":"2026-04-09T01:35:46+00:00","article_modified_time":"2026-04-09T00:53:52+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/","url":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/","name":"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-04-09T01:35:46+00:00","dateModified":"2026-04-09T00:53:52+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/chaos-botnet-now-hits-misconfigured-cloud-servers-sells-your-connection-as-proxy-to-other-attackers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Chaos botnet now hits misconfigured cloud servers, sells your connection as proxy to other attackers"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":152,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/9419","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=9419"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/9419\/revisions"}],"predecessor-version":[{"id":9420,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/9419\/revisions\/9420"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=9419"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=9419"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=9419"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}