Chaos Ransomware Abuses Browsers for Stealthy C2 Communication
The Chaos ransomware group is employing a novel technique using msaRAT to hide its command-and-control (C2) traffic within legitimate browser processes, making detection significantly harder.
Cisco Talos researchers have uncovered a sophisticated new remote access trojan (RAT) dubbed msaRAT, which is being utilized by the notorious Chaos ransomware group. This malware, written in Rust, employs a cunning strategy to conceal its command-and-control (C2) communications by leveraging legitimate browser instances like Google Chrome and Microsoft Edge. The RAT abuses the Chrome DevTools Protocol, a debugging interface, to control these browsers and funnel malicious traffic through a WebRTC channel, effectively camouflaging its activity within normal network traffic.
Once msaRAT infects a system, it initiates its own instance of a compatible browser (Chrome or Edge) in a headless mode, meaning without a visible user interface. This browser instance is configured with a specific user-data directory and has the remote debugging port enabled. The msaRAT then connects to this debugging port via the loopback interface (127.0.0.1). Through this connection, it can disable security policies like Content Security Policy, inject custom JavaScript, and establish a WebRTC channel for C2 communication. The malware's ability to operate hinges on finding a browser executable on the victim's machine; if none is found, the C2 mechanism remains dormant.
The initial infection vector for Chaos ransomware, which has been active since February 2025, typically involves vishing (voice phishing) and spam emails. After gaining initial access, the attackers deploy msaRAT. The delivery mechanism itself is designed to bypass basic network defenses. A curl.exe command downloads an MSI installer disguised as a Windows update into the ProgramData directory. This installer is then executed, with the traffic often using plain HTTP over port 443, which can slip past firewall rules that lack deep packet inspection capabilities. The final stage of installation involves a custom action that loads the msaRAT DLL directly into memory from within the installer package.
Network traffic generated by msaRAT is designed to blend seamlessly with legitimate browser activity. After establishing the initial connection via the DevTools Protocol, the malware uses a Cloudflare Workers endpoint for obtaining connection configuration, setting headers to mimic legitimate Microsoft traffic. A Google STUN server is used for NAT traversal to determine the victim's external IP address. Crucially, the signaling and actual C2 data exchange are routed through a Twilio TURN relay. This multi-hop approach obscures the attacker's true server address, making it difficult to block the malicious traffic without impacting legitimate Cloudflare Workers deployments.
Commands are sent back to the victim machine through the encrypted WebRTC channel. The traffic is protected by DTLS at the transport layer, handled by the browser itself. Additionally, msaRAT implements its own payload encryption, using a key negotiated at the time the C2 connection is established. These commands are then passed to cmd.exe for execution on the victim host, and the output is sent back through the same encrypted channel. Other frame types within the channel are used for managing the connection, performing key exchanges, and terminating the browser process.
Cisco Talos researcher Michael Szeliga emphasized that this technique represents a continuation of a broader trend where attackers increasingly rely on legitimate cloud services and applications to hide their C2 infrastructure. He anticipates that browser-mediated C2 and similar methods, where malicious activity is masked within trusted applications, will become more prevalent. This shift underscores the growing importance of behavior-based detection and endpoint security, especially in combating sophisticated ransomware operations.
From a defensive standpoint, detecting msaRAT is most effective at the endpoint. The key indicators include a browser process launched with specific, non-standard parameters (like a remote debugging port and a custom user-data directory) following the initial MSI download. While network-level detection is challenging due to the layered encryption and use of common protocols, the initial negotiation traffic might reveal a HeadlessChrome user agent. Cisco Talos has released ClamAV signatures and provided indicators of compromise, including the delivery server, signaling domain, and file hashes, to aid defenders in identifying this threat.
This Cisco Talos report provides a deeper technical dive into msaRAT, the Rust-based remote access trojan employed by the Chaos ransomware group. It details how msaRAT exclusively uses the Chrome DevTools Protocol (CDP) to establish covert command-and-control (C2) channels via WebRTC and Cloudflare Workers, avoiding direct network connections. The report also outlines the infection chain, beginning with a disguised MSI file impersonating a Windows update, which then loads the RAT payload into memory.
This new report details the technical implementation of msaRAT's command-and-control (C2) traffic routing, which leverages the Chrome DevTools Protocol (CDP) to control headless browser instances. The malware injects JavaScript into these sessions to establish encrypted communication channels via Cloudflare Workers and Twilio TURN servers, effectively masking its C2 activity within legitimate browser traffic and evading direct network detection.