HIGH Malware #RAT #Rust

msaRAT: Chaos Ransomware's Covert Browser-Based C2

2026-08-08 00:57 UTC 4 min read Runtime Rebel Intel

Primary source: blog.talosintelligence.com

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

msaRAT establishes covert C2 for Chaos ransomware via browser, enabling RCE and data exfiltration.
Affected systems include Windows environments with Chrome or Edge browsers, exploited via MSI installers.
Monitor for suspicious curl commands and unusual browser debugging activity to detect compromise.

Cisco Talos has identified a novel Rust-based remote access Trojan (RAT) named msaRAT, attributed to the active Chaos ransomware group. This new malware is notable for its highly covert command-and-control (C2) communication channel, which entirely leverages legitimate browser debugging APIs and WebRTC to evade traditional network-based detection. Rather than making direct network connections, msaRAT orchestrates its C2 communications by manipulating the browser itself, a technique referred to as “living off the browser.”

Chaos Ransomware Group TTPs

Chaos is a Ransomware-as-a-Service (RaaS) group first observed in February 2025, consistently targeting large organizations with double extortion tactics. Their initial access methods typically involve spam emails and voice-based social engineering (vishing). Post-compromise, the group has historically abused remote monitoring and management (RMM) tools for persistence and utilized legitimate file-sharing software for data exfiltration. The introduction of msaRAT represents an evolution in their post-compromise toolkit, providing a stealthier method for persistent access and remote code execution prior to ransomware deployment, as detailed by Cisco Talos.

msaRAT Technical Deep Dive

msaRAT is written in Rust and utilizes the Tokio asynchronous runtime, enabling it to concurrently execute multiple operations like C2 frame reception, browser command execution, and key exchanges without blocking. Its core functionality revolves around browser-leveraged remote code execution (RCE) and covert tunneling. The RAT never directly touches the network for its C2 operations. Instead, it fully offloads this task to the victim’s web browser, specifically Chrome or Edge.

The RAT achieves this by using the Chrome DevTools Protocol (CDP), a legitimate browser debugging API. msaRAT manipulates the browser via CDP to perform signaling (SDP Offer/Answer exchange) with a Cloudflare Workers endpoint. This process culminates in the establishment of a WebRTC DataChannel between the browser and the C2 server, utilizing Twilio TURN (Traversal Using Relays around NAT) as a relay. This unique approach makes it challenging to detect msaRAT C2 via Chrome DevTools Protocol and traditional network monitoring solutions, as the malicious traffic blends with legitimate browser activity.

Infection Chain and Execution

Upon gaining initial access, attackers deploy msaRAT using a multi-stage process. Talos researchers observed the attacker executing a curl command to download an MSI file, update_ms.msi, from an attacker-controlled server (e.g., http://172.86.126.18:443/update_ms.msi) to the ProgramData directory. Notably, despite specifying port 443, the communication occurs over plain HTTP, which may bypass firewalls configured solely for port-based traffic inspection without protocol awareness.

The update_ms.msi installer is crafted to impersonate a Windows update, embedding a DLL file, lib.dll, that contains the msaRAT payload. Upon execution of the MSI, a custom action triggers lib.dll to be loaded directly into memory. This DLL’s RUN function then initializes the Tokio runtime and begins the process of hijacking the browser for C2.

Actionable Recommendations and Mitigations

Organizations should prioritize several key actions to detect and mitigate threats posed by msaRAT and the Chaos ransomware group:

Monitor for Anomalous curl Activity: Implement logging and monitoring for curl.exe commands, particularly those downloading MSI or executable files to sensitive directories like ProgramData, and especially when communicating over HTTP to non-standard ports or suspicious IP addresses.
Detect Unusual Browser Debugging: Monitor for processes initiating Chrome DevTools Protocol connections, especially if originating from unexpected executables or in unusual contexts. This can help detect attempts to hijack browser functionality to mitigate browser-leveraged RCE.
Egress Filtering and Protocol Inspection: Enhance firewall rules to perform deep packet inspection, not just port-based filtering. This can identify HTTP traffic on non-standard ports, such as 443, to prevent covert downloads.
Network Flow Analysis: Monitor for suspicious outbound connections from browsers to known Cloudflare Workers or Twilio TURN infrastructure that are not part of legitimate application usage. While challenging due to the use of legitimate services, unusual patterns can be indicative of compromise.
Employee Training: Reinforce security awareness training to educate users about vishing and phishing techniques, which are primary initial access vectors for the Chaos group.
Patch Management: Ensure all RMM tools and publicly facing applications are regularly patched and securely configured to deny initial access opportunities often exploited by ransomware groups.

#RAT #Rust

X/Twitter LinkedIn Reddit HN

← Back to Articles