Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

The Chaos ransomware group is leveraging a Rust-based implant called msaRAT to route command-and-control (C2) traffic through headless instances of Chrome or Edge browsers. The malware uses the Chrome DevTools Protocol to drive the browser and establishes WebRTC data channels via Twilio's TURN service, effectively concealing the attacker's infrastructure. C2 traffic is relayed through legitimate services like Cloudflare Workers and Twilio, making detection difficult. The implant is delivered via a malicious MSI installer that mimics a Windows update and loads a DLL into memory.

AI-extracted · verify before operational use