Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor.

The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and drives the browser over the Chrome DevTools Protocol, the browser's own debugging API.

Every C2 message travels out from there through a WebRTC data channel relayed by Twilio's TURN service, so what a defender sees on the wire is a browser calling Cloudflare and Twilio. The attacker's own server address never appears at all.

Chrome Does the Talking

msaRAT looks for Chrome or Edge through environment variables first, then falls back to the registry for Chrome. If no matching browser is found, the CDP path is skipped.

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Other newsrooms on this story

Related reading

New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

Malicious Edge extension abuses Native Messaging as bridge to malware

Crooks found a new way to collaborate using Teams – by hiding…

Malware steals Chrome session cookies to take over your accounts

Ransomware gang abuses Microsoft Teams relays to hide malicious traffic

New 'Mistic' RAT Opens Door to Several Ransomware Families