NEW RUST MALWARE "CHAOSBOT" USES DISCORD FOR COMMAND AND CONTROL

Summary from the TLDR InfoSec newsletter

ChaosBot is a sophisticated Rust-based backdoor that abuses legitimate Discord services for C2 operations. It primarily targets Vietnamese speakers through phishing campaigns with malicious Windows Shortcut files that sideload payloads via legitimate Microsoft Edge components. The malware supports reconnaissance commands (systeminfo, ipconfig, and screenshots), delivers secondary payloads like fast reverse proxy (frp) for persistent network access, and employs evasion techniques including ETW patching and VM detection to bypass security controls. Organizations should monitor for suspicious Discord API traffic, unusual PowerShell execution patterns with UTF-8 encoding prefixes, WMI-based lateral movement from over-privileged service accounts, and unauthorized DLL sideloading in Public user directories.