Researchers from BlackBerry Threat Research and Intelligence spotted a new RAT written in the Go programming language, dubbed ChaChi, which has been used by PYSA (aka Mespinoza) operators to target victims globally.
The name ChaChi comes from two key components of the malware, Chashell and Chisel. Chashell is a reverse shell over DNS provider, while Chisel is a port-forwarding tool. ChaChi has been first observed in the wild in the first half of 2020, but cybersecurity experts underestimated it.
