Back Feeds2.Feedburner

Chaos malware expands from routers to Linux cloud servers

Feeds2.Feedburner •Mirko Zorz • April 8, 2026

Chaos, Go-based malware first documented by Lumen’s Black Lotus Labs, has historically targeted routers and edge devices. A new variant observed in March 2026 shows the malware operating against misconfigured Linux cloud servers, a category of infrastructure the botnet had not previously prioritized. Darktrace’s malware research team documented the compromise through its CloudyPots program, a global honeypot network the company runs to capture attacker behavior across a range of services and cloud platforms. One honeypot … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chaos Malware Variant Targets Misconfigured Linux Cloud Servers A new variant of Chaos malware, originally targeting routers, has been observed exploiting misconfigured Linux cloud servers. This development was documented by Darktrace's CloudyPots program, which captures attacker behavior in real-time. The malware, suspected to be of Chinese origin, utilizes SSH brute-forcing and known CVEs to gain access. The attack vector involves creating a new application on the Hadoop deployment, allowing remote code execution. The malware has evolved, with significant changes in its code structure compared to earlier versions. The domain pan.tenire[.]com, linked to previous campaigns, was also involved in this attack. This shift in targeting marks a significant expansion of Chaos malware's operational scope. The attack was first identified in March 2026, indicating a growing threat landscape for cloud infrastructure. 3 sources 71

Extracted Entities

Chaos malware expands from routers to Linux cloud servers

The full story

Extracted Entities

Attack Types (2)

Platforms (1)

Ransomware Groups (1)

Tools (1)