New Chaos Variant Targets Misconfigured Cloud Deployments, Adds SOCKS Proxy

Researchers observed a new Chaos malware variant targeting misconfigured cloud environments (notably a misconfigured Hadoop instance), delivering a 64-bit ELF agent that supports cryptomining, DDoS, and a newly added SOCKS proxy feature to anonymize malicious traffic; the attack retrieved a binary from pan.tenire.com (previously linked to Silver Fox campaigns), suggesting active exploitation and a shift toward monetization beyond mining and DDoS.