From open source to open threat: Tracking Chaos RAT’s evolution

Acronis TRU analyzed recent Linux and Windows variants of the open-source Chaos RAT (Golang), describing delivery via lures (e.g., NetworkAnalyzer.tar.gz), its cross-platform capabilities (remote shell, file management, screenshots, command execution), embedded Base64 configs and JWTs, and providing IoCs, YARA rules and EDR detection guidance; the report also documents critical flaws in the RAT's admin panel (CVE-2024-30850 and CVE-2024-31839) enabling authenticated RCE and XSS-based exploits that have been demonstrated in the wild.