Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Key Points:

• The Chaos ransomware group uses msaRAT, a Rust-based implant that runs command-and-control (C2) communications through the victim's own Chrome or Edge browser in headless mode, leveraging the Chrome DevTools Protocol (CDP) to avoid direct outbound connections.
• msaRAT routes all C2 traffic via a WebRTC data channel relayed through Twilio's TURN service, disguising malicious traffic as legitimate browser calls to Cloudflare and Twilio, thus hiding the attacker's server address from network defenders.
• The malware arrives post-compromise via a simple curl command downloading a fake Windows update MSI, which loads msaRAT as an embedded DLL into memory; it requires Chrome or Edge to be installed and running headless with remote debugging enabled.
• Detection is challenging because msaRAT does not exploit browser vulnerabilities but relies on observing unusual browser process behavior, such as headless browsers launched by non-interactive parents with remote debugging and loopback traffic to the debugging port.
• Talos emphasizes that blocking Cloudflare Workers or Twilio TURN services is impractical due to their legitimate widespread use, making msaRAT's technique of using these services for C2 signaling a stealthy and adaptable threat vector.