From open-source to open threat: Tracking Chaos RAT’s evolution

Chaos RAT is an open-source remote administration tool written in Golang that has evolved since 2022 to support both Linux and Windows platforms. A critical vulnerability identified as CVE-2024-30850 exists in its web control panel, allowing remote code execution on the server. Although currently limited in usage, Chaos RAT's low detection profile enables threat actors to perform espionage, data exfiltration, and maintain persistent access. The malware employs multiple techniques including privilege escalation, persistence, and command and control communications. Organizations should prioritize patching the vulnerable control panel, restrict access to administrative interfaces, and monitor for indicators of compromise. The threat is assessed as high severity due to its potential impact and ease of exploitation without user interaction. Patch status is not confirmed; no official fix or patch links are provided. The affected platforms include Linux and Windows systems. No specific countries are identified as targeted, but those with significant Linux and Windows server use and strategic geopolitical interests may be at higher risk.

• One leftover build path links an infostealer, a remote-access tool, and a ransomware familyMalware2026-09-01
• Fake MP4 File Carries Malicious PayloadMalware2026-08-29
• ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures Threat Intelligence, Threat Research, Threat SecurityCampaign2026-08-04
• Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet LoaderMalware2026-07-14
• Critical SimpleHelp flaw exploited to deploy new stealer malwareExploitedMalware2026-06-29