Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
Summary: Cisco Talos identified a new Rust-based remote access trojan, msaRAT, used by the Chaos ransomware-as-a-service group, which was first confirmed in February 2025 and targets large organizations with double extortion. The RAT is delivered via an MSI file named "update_ms.msi" that impersonates a Windows update, loads a DLL into memory, and launches Chrome or Edge in headless mode to build a covert command-and-control channel through the browser using the Chrome DevTools Protocol and WebRTC.
What's compelling: The malware routes all traffic through Twilio's TURN relay and Cloudflare Workers, so the attacker's real server IP never appears in network traffic, and it sends data over port 443 as plain HTTP that passes firewalls inspecting only port numbers. A RAT that hides inside a legitimate browser process and a legitimate relay service leaves your network controls with almost nothing to match on.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·