Lumen Black Lotus Labs discovers an expanding, multipurpose botnet called Chaos

DENVER – Black Lotus Labs®, the threat intelligence team at Lumen Technologies (NYSE: LUMN), has discovered a new, rapidly growing, multipurpose malware written in the Go programming language. Dubbed "Chaos" by the author, the malware was developed for Windows, Linux and a wide array of consumer devices, small office/home office (SOHO) routers and enterprise servers.

Key Findings:

Why it Matters:

The prevalence of malware written in Go has increased dramatically in recent years due to its flexibility, low antivirus detection rates and difficulty to reverse-engineer.

The Chaos malware is potent because it works across a variety of architectures, targets devices and systems (e.g., SOHO routers and FreeBDS OS) that are not routinely monitored as part of an enterprise security model, and propagates through known vulnerabilities and SSH keys that are either stolen or obtained through brute force.

Black Lotus Labs' Response:

Black Lotus Labs has null-routed Chaos C2s across the Lumen global backbone and added the IoCs from this campaign into Rapid Threat Defense® – the automated threat detection and response capability that fuels the Lumen Connected Security portfolio by blocking threats before they reach the customer's network.

The team will continue to monitor for new infrastructure, targeting activity and expanding Tactics, Techniques and Procedures (TTPs), and share this information with the security research community.

Read the full press release here.

Lumen