Overview
The Chaos ransomware group has deployed a previously undocumented backdoor called msaRAT — a Rust-based remote access trojan that achieves near-undetectable command-and-control (C2) communication by routing all traffic through Chrome or Edge browsers via the Chrome DevTools Protocol (CDP) and WebRTC data channels. Cisco Talos published their analysis on July 23, 2026.
The technique is notable because defenders never see traffic to the actual C2 server. From the network's perspective, the infected machine is just browsing the web.
How msaRAT Works
The C2 Evasion Architecture
msaRAT never opens a direct outbound network connection. Its process communicates exclusively to 127.0.0.1. The full C2 flow is:
- msaRAT launches Chrome or Edge in headless mode with remote debugging enabled via CDP
- JavaScript executes inside the browser context — the browser process opens a WebRTC data channel
- WebRTC traffic is relayed through Twilio's TURN service — network defenders see connections to Cloudflare and Twilio infrastructure, never the actual C2 server IP
- Commands are structured into protocol frames covering key exchange, session management, channel control, and Windows command execution
The result: all attacker traffic appears as normal browser network activity. Signature-based detections based on unusual outbound connections or known C2 domains are ineffective.
Browser Detection Logic
msaRAT checks six hardcoded filesystem paths across environment variables to locate Chrome and Edge executables:
- Paths under
%LOCALAPPDATA%,%PROGRAMFILES%, and%PROGRAMFILES(X86)%for both browsers - A Chrome-only registry fallback for cases where the binary is not in a standard location
If neither browser is found, the trojan cannot establish its C2 channel — a rare architectural dependency.
Naming Convention
The malware is named after four exported binding functions in the compiled binary: msaOpen, msaClose, msaError, and msaMessage.
Infection Chain
The delivery mechanism is consistent with Chaos's established playbook:
- Initial access via email phishing or voice phishing (vishing), followed by installation of a legitimate remote monitoring and management (RMM) tool for initial foothold
- Attacker executes
curlthrough the RMM session to downloadupdate_ms.msifrom attacker infrastructure over HTTP on port 443 (plain HTTP over the HTTPS port, bypassing port-based firewall rules) - Custom MSI installer action loads a DLL directly into memory — the DLL payload is msaRAT, avoiding disk writes that would trigger AV scanning
Attribution and Threat Actor Context
Cisco Talos attributes msaRAT to the Chaos ransomware group, which emerged in early 2025 and is distinct from an older, unrelated family that shared the Chaos name. Security firm Rapid7 previously linked Chaos to MuddyWater, an Iranian state-backed threat actor — though Talos notes that attribution in this case is focused on the tool and TTPs rather than definitive state sponsorship.
Detection Challenges
| Challenge | Detail |
|---|---|
| No direct C2 connections | All traffic routes through the browser process — process trees are clean |
| Legitimate infrastructure | Twilio / Cloudflare endpoints appear in network logs — not inherently suspicious |
| Headless browser | Chrome/Edge runs silently in the background with no visible window |
| Memory-only payload | DLL loaded directly into memory via MSI, reducing on-disk artifacts |
| Port 443 abuse | HTTP over port 443 bypasses unsophisticated firewall rules expecting only HTTPS |
Detection and Defensive Recommendations
Network Indicators
- Monitor for CDP remote debugging sessions from non-developer processes
- Alert on Chrome or Edge processes spawned by non-standard parent processes (MSI executables, RMM agents)
- Watch for WebRTC data channels from headless browser instances
- Flag
curlorpowershelldownloads over HTTP on port 443
Endpoint Indicators
- Look for
msaOpen,msaClose,msaError,msaMessageexports in scanned DLLs - Detect Chrome/Edge launches with
--remote-debugging-portflags from non-browser parents - Monitor MSI installations executing unusual custom actions that load DLLs into memory
Behavioral Controls
- Restrict RMM tool usage to approved tools and approved accounts
- Block unapproved browser launch parameters (headless mode with debugging flags) via endpoint policy
- Implement DNS-over-HTTPS (DoH) logging to capture WebRTC STUN/TURN server queries
- Train users on vishing as an initial access vector — Chaos operators have used phone-based social engineering effectively