Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Summary: Cisco Talos detailed msaRAT, a Rust implant found on a compromised Windows machine ahead of the Chaos ransomware encryptor, which routes all command-and-control through the victim's own headless Chrome or Edge browser. The implant talks only to 127.0.0.1, drives the browser over the Chrome DevTools Protocol, and sends C2 traffic out through a WebRTC data channel relayed by Twilio's TURN service, so the attacker's server address never appears on the wire.
What's compelling: The two indicators Talos published - a staging IP and a workers.dev hostname - can be swapped out tomorrow, and blocking them would break Cloudflare Workers and Twilio TURN for everyone in your organization; the durable signal is a headless browser spawned by an installer, which is the technique itself and has no browser patch to apply.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026