What it is
Chaos is a botnet program written in Go, a successor to an older botnet called Kaiji. It takes over Linux machines, from routers and other edge devices to cloud servers, and uses them to flood targets with traffic on command (a DDoS attack) or to pass the attacker's traffic through them as a proxy. It copies itself into /etc and runs a small script that keeps restarting it, and newer builds also add a system service. No report describes it hiding itself the way a rootkit does, but because that service has never been named publicly and older builds read SSH keys from the server, we advise rebuilding rather than trusting a cleanup.
How it gets in
In 2022, through weak SSH passwords and router software that hadn't been updated. In 2026, a cloud version got in through Hadoop servers left open to the internet without a login.
Close the door: Do not leave management services such as Hadoop reachable from the internet without authentication; disable remote root login, use SSH keys stored only where needed, change default passwords, and patch router and edge-device firmware.
How to tell if you have it
Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.
| Kind | Sign |
|---|---|
| File location | /etc/id.services.conf |
| File location | /etc/32678 |
| File location | /boot/system.pub |
| File name | id.services.conf |
| File name | system.pub |
| Process name | id.services.conf |
These commands only look. They change nothing.
Look for the known file locations:
sudo ls -la /boot/system.pub /etc/32678 /etc/id.services.conf 2>/dev/nullSearch for the known file names (slow on big disks):
sudo find / -xdev \( -name 'id.services.conf' -o -name 'system.pub' \) 2>/dev/nullLook for the known process names, and where each one runs from:
for p in $(pgrep -f 'id\.services\.conf'); do echo "$p $(sudo readlink /proc/$p/exe)"; doneList running programs that live in a temporary folder (real software almost never does):
sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'Fingerprint a suspect file and compare it with the list below:
sudo sha256sum /path/to/suspect-fileKnown file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.
How sure these signs are: Researchers describe no rootkit for Chaos, so its files are more likely to show up in a check than most threats here. We still advise rebuilding: newer builds start through a system service whose name hasn't been published, so a cleanup can't be sure it found every way back; the 2022 builds read private SSH keys from the server; and servers that also left a service open without a login, like the Hadoop servers in 2026, may have been reached in other ways too. The names are disguised: id.services.conf is a program, not a settings file, and /boot/system.pub is a restart script, not a key. /etc/32678 is a small script that keeps restarting the program. These signs come from 2022 and 2026 samples and fit those builds only. This Chaos is unrelated to the Chaos ransomware builder and an older Chaos SSH backdoor.
How to deal with it
Removing it in place isn't safe. Here is what to do instead, in order:
- Don't try to clean it in place. Plan to rebuild the server from a fresh install.
- Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence: the process list with where each process runs from, your systemd service files, /etc/id.services.conf, /etc/32678, /boot/system.pub, your shell history, and the SHA-256 fingerprint of each suspect file.
- Copy off your data: databases, website files and documents. Don't copy programs, systemd services or scripts from /etc or /boot; any of those could bring it back.
- Reinstall from a fresh image, install all updates, then restore only the data you copied and checked.
- From a clean computer, change every SSH key and password that was on the server, and any other keys it held, and cancel the old ones. The 2022 builds are reported to read private SSH keys from the server.
- Before you reconnect, make sure Hadoop and other management services can't be reached from the internet without a login. Turn off remote root login, keep SSH keys only where they're needed, change default passwords, and update router and device firmware. Keep checking for the signs above.
What Minaki Scan does about it
Minaki Scan looks for this threat and reports it only when at least two signs agree. It never tries to remove it: it tells you to back up your data and rebuild.
Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.
Sources
This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.
- SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
- Darktrace Identifies New Chaos Malware Variant Exploiting Misconfigurations in the Cloud, Darktrace (2026-04-07)
- Chaos is a Go-based Swiss army knife of malware, Lumen Black Lotus Labs