The cybersecurity landscape has witnessed the emergence of a sophisticated new backdoor dubbed msaRAT, a tool currently being deployed by the Chaos ransomware gang to circumvent traditional network security protocols. Unlike conventional malware that establishes direct connections to malicious infrastructure, msaRAT utilizes a "living-off-the-browser" approach, routing its command-and-control (C2) communications through legitimate instances of Google Chrome or Microsoft Edge. By leveraging the Chrome DevTools Protocol (CDP) to manipulate headless browser sessions, the attackers have effectively created a communication channel that is nearly indistinguishable from legitimate web traffic, significantly complicating the task of detection for security operations centers (SOCs) and automated defense systems.
The Evolution of the Chaos Ransomware Group
To understand the threat posed by msaRAT, it is essential to contextualize the actors behind its deployment. The Chaos ransomware group associated with this campaign emerged in early 2025. While it shares a name with a ransomware-as-a-service (RaaS) operation that has been active since 2021, researchers have noted that this 2025 iteration appears to be a distinct entity with more advanced technical capabilities and different strategic objectives.
The name "Chaos" has frequently appeared in threat intelligence reports over the last few years. Earlier in 2025, the Federal Bureau of Investigation (FBI) made headlines by seizing approximately $24 million in Bitcoin from a "new" Chaos ransomware operation, highlighting the group’s rapid ascent and financial impact. Furthermore, the group’s tools have been adopted by state-sponsored actors. Researchers at Rapid7 previously identified that the Iranian state-backed hacking collective known as "MuddyWater" (also tracked as Mango Sandstorm) utilized Chaos ransomware as a decoy. In those instances, the ransomware was used not necessarily for financial gain, but to provide "plausible deniability" for cyber-espionage operations, masking the theft of sensitive data behind the facade of a common criminal extortion attempt.
The deployment of msaRAT represents a significant technological leap for the group. Written in Rust—a programming language increasingly favored by malware authors for its performance, memory safety, and the difficulty it presents to reverse-engineers—msaRAT is designed for stealth and persistence.
Chronology of an Infection: From Phishing to Memory Residency
The infection chain for msaRAT typically begins with social engineering, a tried-and-true method for gaining initial access. According to recent findings from the Cisco Talos research team, the Chaos group initiates attacks through sophisticated email or voice phishing (vishing) campaigns. These lures are designed to trick employees into granting the attackers access to their systems, often under the guise of technical support or urgent corporate communications.
Once the initial foothold is established, the attackers often install legitimate remote management and monitoring (RMM) software. This "living-off-the-land" tactic allows them to maintain persistence without triggering the alarms that custom-built backdoors might set off. With stable access to the environment, the threat actors then transition to the delivery of the msaRAT payload.
The delivery mechanism involves a Microsoft Installer (MSI) file that masquerades as a critical Windows update. When executed, this installer does not write the primary malware executable to the disk in a traditional manner. Instead, it loads the core component of the malware—a dynamic link library (DLL) named lib.dll—directly into the system’s memory. This fileless execution strategy is a key component of the malware’s evasion profile, as it bypasses many legacy antivirus solutions that focus on scanning physical files on the hard drive.
Hijacking the Browser: The Mechanics of msaRAT
Once msaRAT is active in the system memory, it begins its primary mission: establishing a covert communication channel. It achieves this by searching the host system for installations of popular Chromium-based browsers, specifically Google Chrome or Microsoft Edge.
The malware launches the browser in "headless mode." In this state, the browser process runs in the background without a visible user interface or window, making its presence invisible to the average user. After launching the browser, msaRAT enables the remote debugging interface, a feature intended for developers to test web applications. It then connects to this interface using the Chrome DevTools Protocol (CDP).
Through the CDP, the malware gains near-total control over the browser’s internal functions. It opens a new tab and programmatically injects a malicious JavaScript payload. This script is responsible for several critical tasks:
- Bypassing Security Policies: The script is designed to circumvent the browser’s Content Security Policy (CSP), which is normally intended to prevent unauthorized scripts from executing or communicating with unknown domains.
- Establishing CDP Bindings: It registers specific bindings that allow the JavaScript running inside the browser tab to communicate back to the msaRAT process running in the system memory.
- Initiating Signaling: The script contacts a Cloudflare Workers endpoint to begin the process of establishing a network connection.
Leveraging Legitimate Infrastructure for C2 Routing
One of the most innovative aspects of msaRAT is its use of legitimate cloud services to mask its infrastructure. The malware utilizes Cloudflare Workers as a signaling relay. Specifically, researchers identified the endpoint is-01-ast[.]ols-img-12[.]workers[.]dev as a primary contact point.
By using Cloudflare Workers, the attackers gain two major advantages. First, the destination IP address associated with the traffic belongs to Cloudflare, a trusted global service provider. Most firewalls and automated security filters are configured to allow traffic to and from Cloudflare to avoid disrupting legitimate business services. Second, the use of the *.workers.dev subdomain makes it difficult for defenders to block the specific malicious endpoint without potentially blocking thousands of other legitimate applications hosted on the same platform.
To facilitate the actual data transfer, msaRAT employs WebRTC (Web Real-Time Communication), a technology built into modern browsers for peer-to-peer audio, video, and data sharing. The communication is further obscured by routing it through Twilio TURN (Traversal Using Relays around NAT) servers.
Cisco Talos researchers explained that the malware is configured to intentionally omit "ICE candidates"—the pieces of data that usually allow WebRTC to establish a direct peer-to-peer connection. By omitting these candidates, the malware forces the browser to route all traffic through the TURN relay. This ensures that the real IP address of the attacker’s command-and-control server never appears in the victim’s network logs. The only external connections visible to network monitors are to legitimate Cloudflare and Twilio IP addresses.
Dual-Layer Encryption and Data Framing
To protect the integrity and confidentiality of the stolen data and incoming commands, msaRAT employs a sophisticated dual-layer encryption scheme. The first layer is the standard DTLS (Datagram Transport Layer Security) provided by the WebRTC protocol itself. On top of this, msaRAT implements its own custom encryption layer using the ChaCha20-Poly1305 algorithm combined with an Elliptic Curve Diffie-Hellman (ECDH) key exchange.
The data exchange protocol is highly structured. Messages are broken down into "frames," which allow the attackers to manage different types of activity over the same channel. These frames include:
- Key Exchange Frames: For establishing the secondary encryption layer.
- Channel Management: For opening, closing, or resetting communication sessions.
- Command Execution: For sending Windows shell commands to the infected host and receiving the output.
This modular approach allows the malware to function as a fully featured remote access trojan (RAT), capable of file exfiltration, system profiling, and further payload delivery, all while "hiding in plain sight" within the browser’s legitimate encrypted traffic.
Industry Implications and Defensive Challenges
The discovery of msaRAT highlights a growing trend in the cyber threat landscape: the movement toward "Living-off-the-Browser" (LOTB) techniques. As endpoint detection and response (EDR) tools become more adept at identifying suspicious process behaviors and unauthorized network connections, threat actors are shifting their focus to hijacking the most trusted and ubiquitous application on any workstation—the web browser.
The implications for corporate security are profound. Traditional network monitoring that relies on IP reputation or domain blacklisting is largely ineffective against msaRAT because the malware communicates exclusively with high-reputation services like Cloudflare and Twilio. Furthermore, because the traffic is wrapped in standard WebRTC and HTTPS protocols, it easily passes through deep packet inspection (DPI) layers that are not specifically tuned to look for CDP-based manipulation.
Security experts suggest that defending against such threats requires a multi-layered approach:
- Process Monitoring: Organizations should monitor for the unusual use of the
--remote-debugging-portflag in browser processes, especially when launched in headless mode by non-standard parent processes. - Behavioral Analysis: EDR solutions must be configured to detect the injection of code into browser memory space and the subsequent establishment of WebRTC channels from background processes.
- Infrastructure Auditing: Companies using Cloudflare or Twilio should audit their environments for unauthorized workers or relay configurations and monitor for traffic spikes to unusual subdomains.
The Cisco Talos report concludes with a comprehensive list of Indicators of Compromise (IoCs), including specific file hashes and network endpoints. As the Chaos ransomware gang continues to evolve its arsenal, the security community must adapt by looking beyond traditional indicators and focusing on the sophisticated ways in which modern malware subverts the very tools designed to facilitate the modern web. The case of msaRAT serves as a stark reminder that in the realm of cybersecurity, the most dangerous threats are often the ones that look the most normal.
