Full Report
The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and drives the browser
Analysis Summary
This summary provides an overview of the msaRAT implant and the techniques used by the Chaos ransomware group as described in the provided report.
# Tool/Technique: msaRAT (Chaos Ransomware Implant)
## Overview
msaRAT is a sophisticated Rust-based implant used by the Chaos ransomware group. Its primary purpose is to establish a covert Command-and-Control (C2) channel that bypasses traditional network monitoring by routing all outbound traffic through a headless instance of a legitimate web browser (Chrome or Edge) using WebRTC and the Chrome DevTools Protocol (CDP).
## Technical Details
- **Type:** Malware (Implant/RAT)
- **Platform:** Windows
- **Capabilities:** Covert C2 via headless browsers, remote shell execution, secure relaying via STUN/TURN, and defense evasion.
- **First Seen:** July 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1071.001 - Application Layer Protocol: Web Protocols]**: Uses Web protocols via a browser to mask traffic.
- **[T1568.002 - Dynamic Resolution: Domain Generation Algorithms]**: (Implied usage of Cloudflare Workers as proxies).
- **[T1105 - Ingress Tool Transfer]**: Downloading the MSI via `curl.exe`.
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]**: Uses `Page.setBypassCSP` to disable Content Security Policy.
- **[T1564.004 - Hide Artifacts: NT File System Attributes]**: Running browsers in `--headless` mode.
- **[T1218.007 - System Binary Proxy Execution: Msiexec]**: Using MSI custom actions to load DLLs into memory.
- **[TA0002 - Execution]**
- **[T1059.003 - Command and Scripting Interpreter: Windows Command Shell]**: Executes received commands via `cmd.exe`.
## Functionality
### Core Capabilities
- **Browser Orchestration:** Locates Chrome/Edge through environment variables or registry keys and launches them in headless mode.
- **CDP Manipulation:** Interfaces with the browser via the Chrome DevTools Protocol to inject malicious JavaScript.
- **Local Proxying:** The malware process only communicates with `127.0.0.1`, sending data to the browser which then performs the external communication.
- **Remote Shell:** Executes commands on the victim machine using `cmd.exe`.
### Advanced Features
- **WebRTC C2 Tunneling:** Utilizes WebRTC data channels to move traffic, appearing to defenders as standard browser traffic to Cloudflare or Twilio.
- **Infrastructure Masking:** Uses Cloudflare Workers to exchange connection metadata, preventing the attacker’s real IP from appearing in network logs.
- **Double Encryption:** Traffic is protected by the browser's DTLS layer and an internal ChaCha-Poly1305 scheme with an ECDH key exchange.
- **Bypassing Modern Protections:** Brings its own profile directory to bypass Google's restrictions on attaching debuggers to default user profiles.
## Indicators of Compromise
- **File Names:** `update_ms.msi`
- **Network Indicators:**
- `172.86.126[.]18` (Initial download server)
- `is-01-ast[.]ols-img-12[.]workers[.]dev` (C2 Metadata/Cloudflare Worker)
- `global.turn.twilio[.]com` (Turn Relay traffic)
- **Behavioral Indicators:**
- `curl.exe` downloading files to `C:\programdata\`.
- Chrome or Edge running with flags: `--headless=new`, `--remote-debugging-port`, and a custom `--user-data-dir`.
- High volume of WebRTC/DTLS traffic from a headless browser process to Twilio or Cloudflare infrastructure.
## Associated Threat Actors
- **Chaos Ransomware Group**
## Detection Methods
- **Behavioral Detection:** Monitor for unexpected usage of the `--remote-debugging-port` flag in Chrome/Edge, especially when combined with `--headless`.
- **Network Analysis:** Inspect traffic for long-lived WebRTC connections originating from headless browser processes to STUN/TURN relays.
- **Process Monitoring:** Identification of `cmd.exe` or `powershell.exe` being spawned as a child process of a web browser.
## Mitigation Strategies
- **Process Hardening:** Restrict the ability of browsers to launch command-line interpreters.
- **Network Egress Filtering:** Implement protocol-aware inspection (DPI) to identify non-standard traffic on ports 80/443.
- **Attack Surface Reduction:** Block access to known STUN/TURN relay services and Cloudflare Workers if they are not required for business operations.
- **Update Management:** Ensure Windows and browsers are updated, although msaRAT specifically bypasses some recent browser-based debugging restrictions.
## Related Tools/Techniques
- **Living off the Browser:** A technique where attackers use built-in browser features for malicious ends.
- **Ghost Calls:** The conceptual technique of abusing conferencing infrastructure (TURN) for C2.
- **WebRTC Skimmers:** Similar methods used by Magecart-style actors to exfiltrate data.