RAT

CHAOS RAT

CHAOS RAT is an open-source Go remote-access framework with a self-hosted controller that creates configured Windows and Linux clients. Its client connects to an operator-selected controller for remote command handling. Acronis has documented malicious CHAOS RAT Linux samples; the upstream project itself is dual-use.

Visit tool website ↗Download JSON ↓View source YAML ↗Suggest an update ↗

Tool overview

Category: RAT
Research authors: Michael Haag
Created: 2026-09-28
Last modified: 2026-09-28
Privileges: No default service or persistence installer was established in the pinned upstream client source.
Free / availability: Yes
Verification required: Static review of pinned upstream source and Acronis public reporting; no local binary, controller, or sample execution was performed. The client generation service establishes Windows and Linux targets. The report documents malicious Linux samples but does not establish their delivery method.
Supported platforms: LinuxWindows

Capabilities

Self-hosted controller and configured endpoint generationRemote command handlingFile transferSystem information collection

Executables & installation paths

Filename: Not recorded
OriginalFileName: Not recorded
Description: Not recorded

Installation paths

FORENSIC EVIDENCE

Network artifacts

Description: Client server address, port, and authentication values are embedded per build and are operator-selected.
Domains: Not recorded
Ports: Not recorded