/>
X
Innovation

Chaos IoT malware taps Go language to harvest Windows, Linux for DDoS attacks

Cybercriminals are using Google's Go programming language to target connected devices.
Written by Liam Tung, Contributing Writer on
ddos.jpg
Image: Alfa Photo / Shutterstock

A newly discovered cross-platform piece of malware called 'Chaos' is spreading on Linux and Windows systems to amass resources for distributed denial of service (DDoS) attacks against online gaming firms, crypto exchanges, and rival 'stressor' sites renting DDoS-as-a-service.

The malware, which was written in Go – Google's popular cloud and systems programming language – targets Windows and Linux operating systems, and supports multiple chip architectures that allow it to reside on routers, IoT devices, smartphones, and enterprise servers. These include x86, x86-64, AMD64, MIPS, MIPS64, ARMv5-ARMv8, AArch64 and PowerPC, according to Black Lotus Labs, the cybersecurity unit of US internet infrastructure firm Lumen.

Chaos exploits known but unpatched vulnerabilities in firewall devices to gain a foothold in a network. These include critical remote code execution flaws affecting Huawei's HG532 wireless routers for homes and small businesses (CVE-2017-17215) and a newer flaw in Zyxel's routers (CVE-2022-30525).

Also: The scary future of the internet: How the tech of tomorrow will pose even bigger cybersecurity threats

Lumen suggests the malware was created by Chinese actors who picked Go to craft malware that was difficult to reverse engineer. So far it has found 100 samples of Chaos, which allows its operators to profile a host environment, send remote commands to a device, add new capabilities, spread across a network by guessing SSH private keys, and launch DDoS attacks.

The malware has recently been used for DDoS attacks targeting sites in the gaming, financial services and technology, and media and entertainment sectors. It has also targeted a cryptocurrency exchange.

"Given the suitability of the Chaos malware to operate across a range of consumer and enterprise devices, its multipurpose functionality and the stealth profile of the network infrastructure behind it, we assess with moderate confidence this activity is the work of a cybercriminal actor that is cultivating a network of infected devices to leverage for initial access, DDoS attacks and crypto mining," Lumen notes

The firm believes Chaos is a new version of the Kaiji IoT malware, discovered by Linux-focused security researcher MalwareMustDie in 2020

Kaiji was notable because it was written in Go, whereas most other IoT malware until then had been written in C or C++ – two widely used languages for programming software for 'bare metal' and embedded systems.  

According to Lumen, Chaos is installed on a host device and then communicates with the embedded command and control (C2) server. The host receives several staging commands to propagate via a known vulnerability or SSH private keys. 

"Based on the first set of commands, the host may receive a number of additional execution commands including performing propagation via the designated CVE and specified target lists, further exploitation of the current target, launching a specific type of DDoS attack against a specified domain or IP and port, and performing crypto mining," Lumen notes.

So far, Chaos infections are concentrated in Europe, but Lumen's maps also show 'hotspots' in North and South America, as well as Asia Pacific. No bots have been observed in Australia or New Zealand. Lumen saw just over 100 Chaos nodes in September, up from under 20 in April, with a big jump (~40 to ~90) between July and August. 

The Chaos DDoS attacks used the UDP and TCP/SYN protocols across multiple ports. In September, the Chaos actors targeted a gaming site. Also, in mid-August, a DDoS-as-a-service provider that sells CAPTCHA bypass and 'unique' transport layer DDoS capabilities was targeted.

Editorial standards

Related

Microsoft's Windows Subsystem for Linux just hit a major milestone
gettyimages-coworkers-discussing-computer-program-in-office.jpg

Microsoft's Windows Subsystem for Linux just hit a major milestone

Where do tech pros go for tech support? Here are their top 4 fix-it strategies
Young man sitting at home, feeling depressed and trying to contemplate bad news he is reading online using a smart phone

Where do tech pros go for tech support? Here are their top 4 fix-it strategies

Remote work is here to stay. So why is everyone still getting it so wrong?
A white man wearing glasses speaks animatedly while in a remote video conference with four coworkers.

Remote work is here to stay. So why is everyone still getting it so wrong?