Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, attributed to the Chaos ransomware group. The malware leverages Chrome DevTools Protocol (CDP) to hijack a browser and establish a covert command-and-control (C2) channel via WebRTC, using Cloudflare Workers and Twilio TURN for signaling and relay. This technique allows the RAT to avoid direct network communication, instead routing traffic through legitimate browser processes to evade detection and firewall rules.

AI-extracted · verify before operational use