Chaos ransomware msaRAT hides C2 channel in legitimate browser process

Cisco Talos researchers have uncovered a Rust-based remote access trojan linked to the Chaos ransomware group, dubbed msaRAT after four binding names embedded in the binary. This sophisticated tool launches its own instance of Chrome or Edge on the compromised machine and controls it through Chrome DevTools Protocol, a native debugging interface in both browsers. The browser then routes command-and-control traffic over a WebRTC channel, masking malicious activity behind legitimate browser processes.

Once deployed, the RAT process confines its own traffic to 127.0.0[.]1. All external communications flow through a legitimate browser: HTTPS to a Cloudflare developer domain, a STUN request to a Google server, and finally WebRTC to a Twilio relay. Shell commands execute on the victim host, with output returning along the same path. This design requires a browser it can locate on the machine.

Chaos operates as ransomware-as-a-service, confirmed active since February 2025. It uses vishing and spam email for initial access and employs double extortion afterward. Michael Szeliga, a Cisco Talos researcher and co-author of the analysis, was asked what this means for defenders and whether other groups will follow suit.

“This continues the shift defenders have already been dealing with, where attackers use legitimate cloud and collaboration services to hide C2 traffic. I expect browser-mediated C2 and similar approaches to become more prevalent, much like what was demonstrated with Praetorian’s TURNt research using Microsoft Teams TURN infrastructure. Threat actors will continue looking for ways to hide inside trusted applications and services, making behavior-based detection increasingly important, especially in ransomware attacks,” Szeliga told Help Net Security.

Delivery arrives dressed as a Windows update

The operator already has access to the machine when this begins. A curl.exe command pulls an MSI impersonating a Windows update into ProgramData. The attacker then executes it. The URL specifies port 443, the traffic is plain HTTP, and firewall rules that read port numbers without protocol inspection pass it through.

Installation ends with a custom action loading a DLL from inside the installer straight into memory. That DLL is msaRAT.

msaRAT hunts for a browser on disk

msaRAT checks six fixed locations drawn from environment variables, split between Chrome and Edge, then falls back to a registry lookup covering Chrome alone. Finding a browser, it launches a fresh process headless, with the remote debugging port enabled and a user-data directory the malware specifies. Finding none, the entire C2 mechanism sits idle.

The RAT connects to that debugging port over the loopback address, opens a tab in the instance it started, and turns off Content Security Policy for the page. It registers callbacks the browser’s JavaScript uses to report back, then injects JavaScript stored in plaintext inside the binary.

What the network sees is a browser doing WebRTC

The injected JavaScript pulls connection configuration from a Cloudflare Workers endpoint, with Origin and Referer headers set to Microsoft’s website. A Google STUN server handles the NAT lookup that finds the host’s external address. Signaling runs through the Workers endpoint, and the operator’s reply is built to prevent a direct connection, forcing every byte through a Twilio TURN relay. The attacker’s real server address stays out of the packet capture.

Cloudflare Workers exits the picture once the channel opens. Blocking *.workers.dev to cut off that signaling broadly affects legitimate Cloudflare Workers deployments at the same time.

Commands come back as cmd.exe

Traffic inside the channel carries two layers of encryption. DTLS covers the transport by specification, handled by the browser. msaRAT encrypts the payload separately, using a key negotiated the moment the C2 connection opens.

Two of the frame types carry a command string, which the RAT hands to cmd.exe for execution. The output goes back out the same channel. The remaining frames open and close channels, perform the key exchange, and kill the browser process.

Catch it at the host

Szeliga was asked which vantage point gives the best odds of catching it.

“The most reliable place to catch this is at the host, specifically where the browser is launched with set parameters. From a network perspective, the initial negotiation is conducted using HTTPS. From there, not only is the WebRTC traffic encrypted with DTLS and can blend in with ordinary traffic, the RAT adds its own encryption layer to the data. In this case, the earlier the activity can be detected and interrupted on the endpoint, the better,” he explained.

A Chrome or Edge process started with a remote debugging port and a user-data directory the malware specifies is the observable event, and it follows an MSI landing in ProgramData. Talos published a ClamAV signature, Win. Downloader. ChaosRaas-10060321-0. The indicators cover the delivery server, the signaling domain, and a file hash, and they also sit in the Talos GitHub repository. The signaling requests carry a HeadlessChrome user agent, one artifact the network still gets to see. The endpoint holds the rest.