Chaos Ransomware Uses msaRAT to Hide Traffic in Chrome and Edge

The msaRAT backdoor lets the Chaos ransomware gang hide command-and-control traffic inside headless Chrome or Microsoft Edge sessions. This approach makes malicious connections look like normal browser activity and prevents the malware from contacting attacker-controlled servers directly.

The new Rust-based malware uses browser debugging features, Cloudflare Workers, and legitimate Twilio relay servers to conceal the attacker’s infrastructure.

Chaos Ransomware Attacks Deploy msaRAT

Recent Chaos ransomware attacks started with email phishing or voice phishing designed to gain initial access to corporate systems.

After compromising a target, the attackers installed remote management tools to maintain access. They then delivered an MSI package disguised as a legitimate Windows update.

The MSI file loaded msaRAT directly into memory, reducing the number of malicious files written to the device and helping the backdoor avoid file-based security checks.

msaRAT Hijacks Chrome and Microsoft Edge

msaRAT searches the infected computer for Google Chrome or Microsoft Edge. It then launches an available browser in invisible headless mode, which allows the process to run without displaying a normal browser window.

The backdoor enables the browser’s remote debugging interface and communicates with it through the Chrome DevTools Protocol, also known as CDP.

msaRAT instructs the browser to open a new tab and inject JavaScript into it. The injected code creates the communication channel used to exchange commands and data with the attackers.

This design means the backdoor does not need to create its own direct network connection. Security tools may instead see traffic generated by a trusted Chrome or Edge process.

Cloudflare and Twilio Hide the Attack Server

The hijacked browser first contacts an endpoint hosted on Cloudflare Workers to obtain connection details.

The malware then routes communications through legitimate Twilio Traversal Using Relays around NAT, or TURN, servers. TURN services normally relay WebRTC traffic when two devices cannot establish a direct connection.

msaRAT intentionally disables direct peer-to-peer connections and forces all traffic through these relay servers. As a result, the attacker’s real command-and-control server IP address does not appear directly in the victim’s network traffic.

Using Cloudflare and Twilio infrastructure also helps malicious activity blend in with legitimate web services. Blocking the entire workers.dev domain could affect legitimate Cloudflare applications, making broad domain-level blocking difficult.

msaRAT Uses Multiple Encryption Layers

The browser protects WebRTC communications with Datagram Transport Layer Security encryption.

msaRAT adds another encryption layer using ChaCha20-Poly1305 and Elliptic Curve Diffie-Hellman key exchange. This additional protection prevents network monitoring tools from easily inspecting the commands and information transferred through the channel.

The malware divides messages into smaller units called frames before transmitting them. This system supports encrypted key exchanges, session management, and reliable command delivery.

Backdoor Can Execute Windows Commands

msaRAT gives attackers several remote access capabilities after establishing a communication session.

The backdoor can:

• Open and close encrypted communication channels
• Create and manage active sessions
• Reset compromised sessions
• Exchange encrypted keys
• Receive commands from the attacker
• Execute Windows commands remotely
• Divide large messages into smaller frames

These capabilities allow the Chaos ransomware gang to control an infected system while keeping most network activity inside Chrome or Microsoft Edge.

Browser-Based Traffic Complicates Detection

Traditional firewall and network allowlist systems often trust traffic generated by widely used browsers. msaRAT abuses this trust by moving its command-and-control communications into legitimate browser processes.

The malware also avoids opening a direct network socket under its own process. This behavior can make process-based network detection less effective.

Organizations should monitor for unusual Chrome or Edge processes running in headless mode, especially on systems where users do not normally use browser automation tools.

Security teams should also investigate unexpected browser launches that enable remote debugging ports or use the Chrome DevTools Protocol.

Administrators should review published indicators of compromise, restrict unauthorized remote management software, and investigate MSI installers presented as Windows updates.

Users should avoid installing update packages received through unsolicited emails, phone calls, or remote support sessions.

In other security news, the FakeAgent campaign used Bing advertisements to deliver SectopRAT, while another campaign bundled a legitimate copy of Notepad++ with malicious components.

Via BleepingComputer