Cisco Talos published analysis on July 23 of a Rust-based RAT they've named msaRAT, attributed to the Chaos ransomware group. The interesting property is what its own process does on the network, which is nothing.
It never opens an outbound connection. It locates Chrome or Edge, launches the browser headless with the remote debugging port enabled, and drives it over Chrome DevTools Protocol. All C2 traffic leaves from the browser process. From the perspective of a firewall or an EDR watching process-level egress, the RAT is a binary that only ever talks to 127.0.0.1.
One caveat before the walkthrough. Talos places msaRAT after an attacker already has access to a machine. Sophos separately documented a Teams vishing campaign, tracked as STAC4749, that ended in Chaos ransomware in at least three cases. Neither researcher has tied msaRAT to those specific intrusions. What follows is a set of related Chaos observations, not a reconstruction of one confirmed incident.
The social engineering stage
Sophos tracks its campaign as STAC4749. External Microsoft Teams accounts, IT-themed domains under .top, personas with names like AnthonyBrooks and DylanHarper. The operator calls, presents as helpdesk, and walks the target into opening a remote support session. Call length clustered between two and two and a half minutes.
