No Happy Days for US Schools Infected with ChaChi

Security researchers have discovered a new Trojan written in the GoLang (Go) programming language shifting from its original target of government agencies to focus instead on US schools. The trojan, dubbed ChaChi, is also a key component in launching ransomware attacks. ChaChi was first discovered in 2020, attacking local French government entities. The latest version of ChaChi appears to be a more sophisticated variant that focuses on US-based educational organizations and schools.

The current malware includes improved obfuscation and can perform remote access trojan (RAT) activities, such as backdoor creation and data exfiltration, credential dumping, DNS tunneling, network enumeration, SOCKS proxy functionality, service creation, and lateral movement across networks.

The ChaChi name is derived from the use of two off-the-shelf tools known as Chasell (a reverse shell-over DNS provider) and Chisel (a port-forwarding system.)

Researchers believe the ChaChi malware is the work of a threat group known as PYSA/Mespinoza, known for using the extension PYSA which stands for “Protect Your System Amigo.”

Check out our other blog posts from this past week.