Chaos Ransomware Group Exploits Browsers for Covert Command and Control with New msaRAT Malware

The emerging threat landscape of cyber warfare has seen a sophisticated new tactic employed by the Chaos ransomware gang, a group that has recently garnered attention for its evolving operational methods. Security researchers have uncovered a novel backdoor malware, dubbed msaRAT, which leverages the ubiquitous presence of web browsers like Google Chrome and Microsoft Edge to mask its command-and-control (C2) communications. This ingenious evasion technique significantly reduces the likelihood of detection by routing all network traffic through legitimate browser processes, thereby blending malicious activity with routine web browsing.

This development marks a significant escalation in the sophistication of ransomware operations, moving beyond traditional direct connections to C2 servers, which are often easier to identify and block. The msaRAT malware’s reliance on the Chrome DevTools Protocol (CDP) to orchestrate a headless browser session underscores a growing trend of threat actors exploiting legitimate software functionalities for malicious purposes. The Rust programming language, known for its performance and memory safety, is the foundation of msaRAT, further indicating the investment in developing robust and stealthy malware.

Background on the Chaos Ransomware Gang

The Chaos ransomware group first surfaced in early 2025, distinct from an earlier ransomware family of the same name that had been active since 2021. This new iteration of Chaos has demonstrated a capacity for adaptation and has been linked to state-sponsored cyber operations. Earlier in 2025, security researchers at Rapid7 identified a connection between the Chaos ransomware and Iranian state-backed hacking collective "MuddyWater." In these instances, Chaos ransomware was reportedly used as a decoy, a smokescreen to disguise cyber-espionage activities as financially motivated ransomware attacks. This dual-use strategy highlights the group’s flexibility and its ability to cater to different patron interests, ranging from financial gain to geopolitical intelligence gathering.

The modus operandi of the Chaos group has also been observed to involve more traditional vectors, such as spear-phishing emails and voice phishing (vishing) campaigns. Following initial compromise, the attackers have been noted to install remote management software to establish persistence within victim networks. This persistence is crucial for maintaining access and executing subsequent stages of the attack, including the deployment of their advanced malware.

Infection Chain and msaRAT Deployment

Cisco Talos, a leading cybersecurity research team, has detailed a specific infection chain observed in recent Chaos ransomware attacks. The process typically begins with a deceptive lure, often an MSI (Microsoft Installer) package disguised as a critical Windows update. Upon execution, this installer silently loads the msaRAT backdoor, identified as "lib.dll," directly into the system’s memory. This in-memory deployment method bypasses traditional file-based detection mechanisms, making it harder for security software to identify and quarantine the malicious payload.

Once activated, msaRAT meticulously searches for instances of Google Chrome or Microsoft Edge on the compromised system. The malware then initiates these browsers in "headless" mode. Headless operation means the browser process runs in the background without a visible user interface, allowing for stealthy execution. This is a critical step in the malware’s evasion strategy, as it ensures that the browser’s activity appears as normal user behavior to the casual observer, and even to some automated security tools.

Hijacking Browser Functionality for C2

The core of msaRAT’s stealth lies in its exploitation of the Chrome DevTools Protocol (CDP). CDP is a powerful API that allows external applications to inspect, debug, and control Chromium-based browsers. msaRAT leverages CDP to establish a connection with a headless browser session. It then enables the browser’s remote debugging interface, a feature typically used by developers for troubleshooting.

Following the connection to the debugging interface, msaRAT commands the headless browser to open a new tab. Into this tab, it injects specially crafted JavaScript code. This JavaScript is instrumental in constructing the communication channel. It is designed to bypass the browser’s Content Security Policy (CSP), a security feature that restricts the domains from which a web page can load resources, and establishes several CDP bindings. These bindings act as communication conduits, enabling the malware to send and receive data to and from its C2 infrastructure.

This intricate process ensures that all command-and-control traffic is routed through the browser, mimicking legitimate web activity. By obscuring its network communications within the vast amount of data that flows through a web browser, msaRAT significantly lowers the risk of detection by network security monitoring tools that typically focus on direct, unusual network connections.

The Role of Cloudflare Workers and Twilio TURN Servers

The ultimate destination for msaRAT’s C2 traffic is a Cloudflare Workers endpoint, specifically identified as is-01-ast[.]ols-img-12[.]workers[.]dev. Cloudflare Workers are a serverless computing platform that allows developers to run code at the edge of Cloudflare’s global network. By using this infrastructure, the attackers gain several advantages. Firstly, the destination IP address is attributed to Cloudflare, a reputable and widely trusted service provider. This often allows the traffic to bypass strict firewall rules and allowlist automatic verification, as it appears to be legitimate traffic to a known service.

Furthermore, the use of a free subdomain like workers.dev is common for developers, and blocking such a subdomain would have widespread negative consequences for legitimate Cloudflare Workers deployments and other benign services. This makes it a challenging target for security teams to block without causing collateral damage.

To facilitate secure and resilient communication, msaRAT employs a multi-layered encryption strategy. The initial layer of encryption is provided by WebRTC’s Datagram Transport Layer Security (DTLS), a protocol that is automatically handled by the browser. On top of this, msaRAT implements its own encryption using the ChaCha20-Poly1305 cipher with Elliptic Curve Diffie-Hellman (ECDH) key exchange. This dual-layer approach significantly enhances the confidentiality of the communication channel.

The crucial element in msaRAT’s communication architecture is its reliance on Twilio’s TURN (Traversal Using Relays around NAT) servers. TURN servers act as intermediaries to facilitate peer-to-peer connections when direct connections are not possible due to network address translation (NAT) or firewalls. However, msaRAT intentionally omits specific "ICE candidates" (Interactive Connectivity Establishment) that are normally present in standard WebRTC communications. This deliberate omission prevents direct peer-to-peer connections from being established, ensuring that all communication is systematically routed through Twilio’s TURN servers.

"By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN," explained Cisco Talos in their report. This forced relaying through a third-party service further obfuscates the true origin and destination of the C2 traffic.

"By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Workers makes it significantly difficult to trace the attacker’s infrastructure," the researchers added. This intricate web of legitimate services, when manipulated by msaRAT, creates a formidable challenge for attribution and takedown efforts.

Analysis of Communication Protocol and Data Exchange

Cisco Talos researchers have meticulously analyzed the data exchange mechanism employed by msaRAT. The malware breaks down communication into discrete chunks, referred to as "frames." These frames contain critical information, including key exchanges for establishing encryption, commands for opening and closing communication channels, instructions for session resets, and commands for executing operations on the victim’s Windows system. The structured nature of these frames, while necessary for communication, also provides valuable forensic data for security analysts attempting to understand and disrupt the malware’s operations.

The implications of this sophisticated C2 infrastructure are profound. By seamlessly integrating its malicious traffic within the normal flow of web browsing and leveraging established, trusted cloud services, msaRAT achieves a high degree of stealth. This allows the Chaos ransomware group to maintain persistent access to victim environments, exfiltrate sensitive data, deploy ransomware payloads, or conduct espionage operations with a greatly reduced risk of detection by conventional security measures.

Broader Impact and Implications

The emergence of msaRAT signifies a notable advancement in the tactics, techniques, and procedures (TTPs) used by ransomware gangs and potentially state-sponsored actors. This technique of hijacking legitimate browser functionalities for C2 communication presents a significant challenge for security teams. Traditional network intrusion detection systems (NIDS) that rely on identifying anomalous network traffic patterns may struggle to distinguish between legitimate browser activity and msaRAT’s covert communications.

The reliance on Cloudflare Workers and Twilio TURN servers highlights the growing trend of threat actors exploiting the vast and complex ecosystem of cloud services. This not only makes attribution difficult but also complicates takedown operations, as disrupting these services could have significant repercussions for legitimate users.

For organizations, this development underscores the critical need for enhanced endpoint detection and response (EDR) capabilities, which can monitor process behavior and network connections at a granular level. Furthermore, it emphasizes the importance of robust security awareness training to mitigate the effectiveness of phishing and vishing attacks, which serve as the initial entry points for such sophisticated malware. The analysis by Cisco Talos provides a valuable set of Indicators of Compromise (IoCs), including network addresses and file hashes, which security professionals can use to detect and defend against msaRAT.

In conclusion, msaRAT represents a significant evolution in malware stealth capabilities, demonstrating the increasing ingenuity of threat actors in evading detection. The Chaos ransomware group’s adoption of this technique signals a new frontier in cyber threats, demanding continuous adaptation and innovation from cybersecurity defenders. The ability of msaRAT to blend in with everyday web traffic, coupled with its layered encryption and reliance on legitimate cloud infrastructure, positions it as a formidable tool for persistent, covert cyber operations.