New msaRAT malware uses Chrome and Edge browsers to route C2 traffic

Cybersecurity researchers have identified a sophisticated new backdoor dubbed msaRAT, currently being deployed by the Chaos ransomware gang to circumvent traditional network security perimeters. Unlike conventional malware that establishes direct connections to attacker-controlled infrastructure, msaRAT leverages the legitimate processes of Google Chrome and Microsoft Edge to tunnel its command-and-control (C2) traffic. By utilizing the Chrome DevTools Protocol (CDP) to manage headless browser sessions, the malware ensures that its malicious communications are indistinguishable from standard web browsing activity, effectively neutralizing many signature-based detection systems.

The emergence of msaRAT represents a significant escalation in the technical capabilities of the Chaos ransomware group. This development was recently detailed in a comprehensive report by Cisco Talos, which documented the malware’s unique reliance on WebRTC, Cloudflare Workers, and Twilio TURN servers. By layering its traffic through these legitimate services, the attackers have created a highly resilient and stealthy infrastructure that presents a formidable challenge to incident responders and network administrators alike.

The Evolution and Attribution of the Chaos Ransomware Group

To understand the threat posed by msaRAT, it is essential to distinguish between the various entities operating under the "Chaos" moniker. The current iteration of the Chaos ransomware group emerged in early 2025 and is considered distinct from the original Chaos ransomware family that gained notoriety in 2021. While the earlier version was largely characterized by its "builder" software that allowed low-level cybercriminals to create their own strains, the 2025 variant is associated with more sophisticated, targeted operations.

The group’s profile is further complicated by its ties to state-sponsored activity. Earlier this year, researchers at Rapid7 established a link between Chaos ransomware and "MuddyWater," a threat actor group attributed to Iran’s Ministry of Intelligence and Security (MOIS). In those instances, the ransomware was utilized as a "decoy" or "distraction" to mask espionage activities. By deploying ransomware, the state-backed actors could frame their operations as financially motivated cybercrime, leading investigators away from the true goal of data exfiltration and geopolitical surveillance.

The recent discovery of msaRAT suggests that the Chaos group—or the actors leveraging their tools—has moved toward a "living-off-the-browser" strategy. This approach aligns with the broader industry trend of "Living off the Land" (LotL), where attackers use legitimate system tools and installed software to carry out their objectives, thereby reducing the footprint of malicious code.

Detailed Chronology of the msaRAT Infection Chain

The deployment of msaRAT follows a multi-stage infection vector that prioritizes human fallibility and administrative oversight. Based on observations by Cisco Talos, the attack sequence typically unfolds as follows:

1. Initial Access via Social Engineering: The campaign begins with highly targeted email or voice phishing (vishing). Attackers pose as IT support staff or service providers to trick employees into granting access or downloading initial utility software.
2. Persistence through Remote Management: Once initial contact is established, the attackers install legitimate remote monitoring and management (RMM) tools. These tools allow the threat actors to maintain a foothold in the environment without triggering the alerts usually associated with unauthorized remote access software.
3. The Malicious Update Payload: After establishing persistence, the attackers download a Windows Installer (MSI) package. This package is frequently disguised as a critical Windows Update or a necessary security patch.
4. In-Memory Execution: The MSI installer does not write the primary malware to the disk in a traditional sense. Instead, it loads msaRAT, often named lib.dll, directly into the system’s memory. This fileless execution technique is designed to bypass antivirus solutions that focus on scanning physical files on the hard drive.
5. Browser Hijacking: Once active in memory, msaRAT scans the infected host for the presence of Google Chrome or Microsoft Edge. It then initiates a "headless" instance of the browser—a version that runs in the background without a visible user interface.

Technical Analysis: Hijacking the Chrome DevTools Protocol

The core innovation of msaRAT lies in its use of the Chrome DevTools Protocol (CDP). CDP is a professional toolset used by developers to debug, profile, and instrument Chromium-based browsers. By programmatically connecting to the browser via CDP, msaRAT gains total control over the browser’s internal functions.

Once the headless browser is launched with the remote debugging interface enabled, msaRAT connects to it and opens a new tab. It then uses CDP to inject custom JavaScript into that tab. This injected code serves as the bridge between the malware’s core logic and the internet. Because the JavaScript is executing within the context of a legitimate browser process (chrome.exe or msedge.exe), any network traffic it generates is tagged by the operating system and firewalls as "browser traffic."

This mechanism effectively bypasses Content Security Policies (CSP) and other browser-level protections. The malware registers specific CDP bindings, allowing the Rust-based malware component and the injected JavaScript to exchange data seamlessly. This architecture ensures that the "heavy lifting" of network communication is handled by the browser’s own optimized networking stack.

Infrastructure and Evasion: Cloudflare and Twilio Integration

The msaRAT C2 architecture is a masterclass in using legitimate cloud infrastructure to hide malicious intent. The communication flow is designed to ensure that the attacker’s true IP address is never exposed to the victim’s network.

The Role of Cloudflare Workers

The initial signaling phase of the communication utilizes Cloudflare Workers. The malware contacts a specific workers.dev endpoint to retrieve configuration data and WebRTC connection details. Cloudflare Workers is a serverless platform that allows developers to run code at the "edge" of the internet. For an attacker, this provides several advantages:

• Reputation: Traffic to Cloudflare is generally trusted.
• IP Masking: The destination IP address belongs to Cloudflare, not the attacker.
• Blocking Difficulty: Security teams cannot easily block the workers.dev domain because it hosts thousands of legitimate applications. Blocking it would cause significant collateral damage to business operations.

WebRTC and Twilio TURN Servers

After receiving the necessary metadata from Cloudflare, the malware establishes an encrypted channel using WebRTC (Web Real-Time Communication). WebRTC is a standard protocol for peer-to-peer (P2P) communication, typically used for video conferencing.

However, msaRAT is configured to avoid direct P2P connections, which might reveal the attacker’s IP. Instead, it routes all traffic through Twilio TURN (Traversal Using Relays around NAT) servers. By omitting "ICE candidates" (Interactive Connectivity Establishment) that would normally facilitate a direct connection, the malware forces the browser to use the TURN relay as a proxy. This ensures that the only external IP address visible in the victim’s network logs is that of a legitimate Twilio service.

Dual-Layer Encryption and Command Execution

Security researchers identified that msaRAT employs a redundant, two-layer encryption scheme to protect its C2 instructions:

1. Transport Layer: The WebRTC protocol itself provides Datagram Transport Layer Security (DTLS) by default.
2. Application Layer: On top of the browser’s encryption, msaRAT implements its own layer using the ChaCha20-Poly1305 algorithm combined with an Elliptic Curve Diffie-Hellman (ECDH) key exchange.

The data exchange is broken down into specific "frames." Researchers documented various frame types that allow the attacker to perform several actions, including:

• Key Exchange: Establishing the unique encryption keys for the session.
• Channel Management: Opening and closing specific communication streams.
• System Commands: Executing arbitrary Windows commands via the cmd.exe shell.
• Persistence Maintenance: Resetting sessions to ensure the connection remains active even after network interruptions.

Analysis of Implications and Broader Impact

The discovery of msaRAT signals a shift toward more complex, "invisible" backdoors that exploit the very tools users rely on for daily work. The use of the Rust programming language is also notable; Rust’s memory safety features and performance make it an increasingly popular choice for malware authors looking to create stable, cross-platform, and difficult-to-reverse-engineer binaries.

For organizations, the implications are profound. Traditional "Allow/Deny" lists for IP addresses are rendered ineffective when attackers route traffic through Cloudflare and Twilio. Furthermore, because the traffic is encapsulated within WebRTC and encrypted twice, standard Deep Packet Inspection (DPI) tools may fail to identify the malicious nature of the payloads.

Industry experts suggest that this discovery highlights a critical gap in browser security. While browsers have become more secure against external web threats, they remain vulnerable to being "driven" by malicious local processes. This "inside-out" attack vector suggests that security teams must move beyond monitoring what the browser is visiting and start monitoring how the browser is being launched and controlled.

Recommendations for Defense and Mitigation

Cisco Talos has released a comprehensive list of Indicators of Compromise (IoCs), including specific Cloudflare Worker subdomains and file hashes for the lib.dll components. However, because the attackers can easily rotate these assets, defenders should focus on behavioral detection:

• Monitor for Headless Browsers: Security Operations Centers (SOCs) should alert on instances of chrome.exe or msedge.exe running with the --headless or --remote-debugging-port flags, especially when initiated by non-standard parent processes.
• Audit MSI Installations: Implement strict controls on the execution of MSI files, particularly those that do not originate from trusted enterprise software repositories.
• Network Behavioral Analysis: While the IP addresses are legitimate, the volume and timing of WebRTC traffic to TURN servers from a headless browser may deviate from normal user behavior patterns.
• Zero Trust Architecture: Adopting a Zero Trust model that scrutinizes every process’s attempt to access network resources, regardless of the application’s reputation, is essential to countering "Living off the Land" threats like msaRAT.

As the Chaos ransomware group continues to refine its arsenal, the cybersecurity community must remain vigilant. The integration of legitimate cloud services and browser protocols into malware frameworks is no longer a theoretical risk but a documented reality that requires a fundamental rethink of network visibility and process monitoring.