Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Overview

The Chaos ransomware group has deployed a sophisticated Rust-based remote access trojan dubbed msaRAT that routes its entire command-and-control (C2) channel through the victim's own installed web browser — making malicious traffic indistinguishable from routine browser network activity.

Cisco Talos published its full technical analysis on July 23, 2026, after discovering the implant on a compromised Windows machine during an incident response engagement. The technique has been described as "living off the browser" — an analogy to living-off-the-land attacks that abuse OS-native tools, extended here to abuse a victim's own Chrome or Edge installation.

How msaRAT Works

The implant is built on the Tokio asynchronous runtime in Rust. Its four core CDP binding names — msaOpen, msaClose, msaError, and msaMessage — give the malware its name, with a fifth binding (dataAck) handling flow control.

The key design principle: the malware process itself makes zero outbound network connections. Every byte of C2 traffic is handled entirely by the browser process.

Step-by-Step Attack Chain

1. Browser discovery: msaRAT searches for Chrome or Microsoft Edge via environment variables, then the Windows registry
2. Headless launch: The browser is launched invisibly with --headless --remote-debugging-port flags — no visible window appears
3. CDP attach: The implant connects to the browser's Chrome DevTools Protocol (CDP) interface over 127.0.0.1
4. JavaScript injection: A new browser tab opens; JavaScript is injected via CDP commands, bypassing Chrome's Content Security Policy
5. Cloudflare Workers signaling: The injected JS fetches STUN/TURN configuration from a Cloudflare Workers endpoint, with Origin and Referer headers spoofed to impersonate a Microsoft domain
6. WebRTC SDP exchange: An SDP offer/answer is posted to the Cloudflare Worker. The answer deliberately returns no ICE candidates with address 0.0.0.0 — preventing any direct peer-to-peer path
7. Twilio TURN relay: With no ICE candidates, all traffic is forced through Twilio's TURN relay (global.turn.twilio.com). The C2 server address never appears on the wire
8. Double encryption: Traffic is encrypted at two layers — browser DTLS at the WebRTC level, plus an inner ChaCha-Poly1305 symmetric layer keyed via ECDH key exchange

What Defenders See on the Wire

• Browser HTTPS requests to Cloudflare (*.workers.dev) — widely allowlisted
• A STUN request to a Google server — routine browser behaviour
• WebRTC UDP traffic to Twilio — common in VoIP and video conferencing apps

The attacker's actual C2 server address is completely invisible. The only identifiable artifact is the HeadlessChrome user-agent string appearing in WebRTC signaling requests.

The Chaos Ransomware Group

The Chaos group emerged in February 2025 — distinct from an older unrelated "Chaos" malware family. Cisco Talos assesses with moderate confidence that the group comprises former members of BlackSuit (Royal) ransomware, who reformed after the U.S. Department of Justice seized BlackSuit's infrastructure in July 2025.

MuddyWater False Flag Warning

Rapid7 has separately identified cases where MuddyWater (Seedworm) — an Iranian state-sponsored APT affiliated with MOIS — has used Chaos ransomware branding as a false flag. In these incidents, ransom demands were made and data was published to the Chaos leak site, but no files were actually encrypted. The real objective was credential theft and persistent access, not financial extortion. Defenders facing what appears to be Chaos ransomware should consider the possibility of an Iranian intelligence operation.

Full Attack Chain

The broader kill chain observed by Talos:

1. Initial access: Phishing email or voice phishing (vishing)
2. Persistence: Installation of legitimate RMM tools (AnyDesk and similar)
3. Delivery: MSI installer disguised as a Windows update, downloaded via curl.exe
4. In-memory load: MSI drops and loads lib.dll directly into memory — no disk artifact
5. msaRAT execution: Browser-based C2 channel established as described above
6. Pre-ransomware: Data exfiltration, lateral movement
7. Ransomware deployment: Chaos encryptor deployed for double extortion

Detection and Hunting Guidance

Behavioral Sequence to Hunt

MSI execution
  → in-memory DLL load
  → Chrome/Edge launch with --remote-debugging-port
  → CDP connection to localhost
  → Cloudflare Workers HTTPS (signaling)
  → WebRTC UDP to Twilio TURN

Network Indicators

• HeadlessChrome user-agent in HTTP/S requests
• Unexpected browser processes running on servers or unattended workstations
• curl.exe invocations from unexpected parent processes
• MSI execution followed shortly by RMM tool installation

Endpoint Hardening

• Alert on Chrome/Chromium processes started with --remote-debugging-port outside of known CI/CD or testing contexts
• Audit for RMM tools not in your approved software inventory
• Consider application allowlisting to block unauthorized MSI installations

AV Signature

ClamAV signature Win.Downloader.ChaosRaas-10060321-0 has been released to detect this threat.

Indicators of Compromise (IOCs) — including the delivery server, signaling domain, and lib.dll file hash — are available on the Talos GitHub repository.

Prior Art and Broader Implications

Talos notes two prior research contributions that presaged this technique:

• Praetorian (August 2025): Demonstrated TURN infrastructure could carry a full C2 channel via conferencing platforms
• Sansec (March 2026): Found a payment card skimmer using WebRTC data channels to exfiltrate stolen card data past HTTP inspection

msaRAT is the first known threat-actor-deployed implant combining both techniques in a Rust binary distributed through a RaaS operation.

References

• Cisco Talos — Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
• BleepingComputer — New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
• The Hacker News — Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
• Rapid7 — Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware
• Help Net Security — Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process