New msaRAT malware hijacks Chrome, Edge browsers for C2 traffic

A new backdoor known as msaRAT is being deployed by the Chaos ransomware gang, with a clever trick to evade detection: it routes all command-and-control (C2) traffic through the victim’s Chrome or Microsoft Edge browser. Written in Rust, this malware leverages the Chrome DevTools Protocol (CDP) to command a headless browser session, establishing a covert link to the attacker’s server without making any direct network connections. This approach significantly lowers the risk of discovery, as the C2 traffic blends into normal browsing activity.

The Chaos ransomware group first appeared in early 2025, distinct from a similarly named ransomware family that had been active since 2021. Earlier this year, researchers at Rapid7 linked Chaos to the Iranian state-backed hacking group MuddyWater, who used it to disguise cyber-espionage operations as financially motivated attacks. More recently, the Cisco Talos research team observed Chaos attacks starting through email or voice phishing, followed by the installation of remote management software to establish persistence. Once inside the network, attackers download an MSI installer disguised as a Windows update, which loads msaRAT (lib.dll) directly into system memory.

Upon execution, msaRAT searches for Chrome or Microsoft Edge and launches the browser in headless mode , running without a visible window. It then enables the browser’s remote debugging interface and connects via CDP. A new tab is opened, and JavaScript is injected using CDP commands to build the communication channel, bypass Chrome’s Content Security Policy (CSP), and register CDP bindings for data exchange.

The browser then contacts a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to obtain WebRTC connection information and establish an encrypted channel. Cisco Talos explains that two layers of encryption are used: the WebRTC DTLS protocol, automatically provided by the browser, and a ChaCha20-Poly1305 + ECDH key implemented by msaRAT. Communication is relayed through Twilio TURN servers with a specific configuration that avoids direct peer-to-peer connections. By intentionally omitting standard ICE candidates, all traffic is forced through TURN, hiding the attacker’s real IP address. The dual-layer infrastructure , combining Twilio with Cloudflare Workers , makes tracing the attacker’s server extremely difficult.

The data exchange system breaks messages into chunks called “frames,” handling key exchanges, channel opening and closing, session resets, and Windows command execution. By using Cloudflare Workers as the signaling relay, the attacker’s server remains protected behind Cloudflare’s IP address, easily passing firewall and allowlist checks. Blocking the `*.workers.dev` free subdomain would disrupt legitimate Cloudflare deployments and affect benign services.

Cisco Talos emphasizes that msaRAT’s communication mechanism allows it to control C2 exchanges without touching the network directly, burying it within normal web traffic. The full report includes a comprehensive list of indicators of compromise (IoCs) associated with these attacks.