Don’t swing at everything

Cisco Talos has identified a new Rust-based remote access trojan (RAT) named msaRAT, deployed by the Chaos ransomware group. The malware leverages the Tokio asynchronous runtime and hijacks Chrome or Edge browsers via the Chrome DevTools Protocol (CDP) to establish a covert command-and-control (C2) channel. It is distributed through a deceptive MSI file impersonating a Windows update, enabling in-memory execution and evasion of traditional network detection. The RAT facilitates double-extortion ransomware attacks by enabling persistence and lateral movement.

AI-extracted · verify before operational use