New msaRAT Malware Leverages Legitimate Browsers for Stealthy Command-and-Control Communication

The cybersecurity landscape has been significantly impacted by the emergence of a sophisticated new malware strain, dubbed msaRAT, which is being employed by the financially motivated Chaos ransomware gang. This novel backdoor distinguishes itself by ingeniously disguising its command-and-control (C2) communications, routing them through the widely used Google Chrome and Microsoft Edge browsers. This tactic not only obfuscates the malware’s true origins but also dramatically reduces its detectability, presenting a formidable challenge for security professionals.

Written entirely in the Rust programming language, msaRAT’s operational prowess is deeply intertwined with its exploitation of the Chrome DevTools Protocol (CDP). By leveraging CDP, the malware gains the ability to remotely control a headless browser instance—a browser that runs in the background without a visible graphical user interface. This controlled environment allows msaRAT to establish covert connections to its C2 servers, effectively mimicking legitimate browser activity and blending seamlessly with normal network traffic. The critical implication of this methodology is that the malware bypasses the need for direct, identifiable connections to attacker-controlled infrastructure, thereby significantly diminishing the likelihood of detection by traditional security monitoring tools that typically flag direct C2 communications.

Background on the Chaos Ransomware Gang

The Chaos ransomware gang, the perpetrator behind msaRAT’s deployment, is a relatively recent but impactful entity in the cybercrime ecosystem. This particular iteration of the Chaos group emerged in early 2025, and it is important to note that it is distinct from an earlier ransomware family bearing the same name, which had been active since 2021. This distinction is crucial for understanding the evolving threat landscape and the potential for new threat actors to adopt familiar branding.

Earlier in 2025, researchers at Rapid7 identified a significant association between the Chaos ransomware and state-sponsored hacking operations. Specifically, it was discovered that Iranian state-backed actors, operating under the moniker "MuddyWater," were utilizing Chaos ransomware as a deceptive tactic. In these sophisticated cyber-espionage campaigns, the ransomware was employed not for its typical financial extortion purposes, but rather as a smokescreen to mask their true objectives, which were rooted in intelligence gathering and persistent access. This revelation highlighted the adaptability of ransomware strains and their potential to be repurposed for diverse malicious objectives beyond simple financial gain.

More recent observations by the Cisco Talos research team have shed further light on the current modus operandi of the Chaos ransomware attacks. These campaigns are initiated through highly deceptive social engineering tactics, primarily email or voice phishing. Once a victim falls prey to these initial attacks, the attackers proceed to establish persistence within the compromised environment. A common method for achieving this involves the installation of legitimate remote management software, which then serves as a stable foothold for subsequent malicious activities.

The infection chain, as detailed by Cisco Talos, typically involves the attacker downloading a seemingly innocuous MSI (Microsoft Installer) package. This package is often disguised as a routine Windows update, a tactic designed to exploit users’ trust in system-level updates. Upon execution, this installer discreetly loads msaRAT, specifically a component identified as lib.dll, directly into the system’s memory. This in-memory execution further complicates detection, as it often bypasses traditional file-based scanning mechanisms.

H2: The Ingenious Mechanism of Browser Hijacking

The core of msaRAT’s stealth lies in its sophisticated exploitation of web browsers. Upon activation, the malware actively scans the compromised system for instances of Google Chrome or Microsoft Edge. Once identified, it initiates a headless session of the chosen browser. This headless mode is critical, as it allows the malware to operate entirely behind the scenes, without any visual cues to the user that a browser is even running.

Following the launch of the headless browser, msaRAT proceeds to enable the browser’s remote debugging interface. This interface, typically used by developers for troubleshooting and inspecting web applications, is then accessed by msaRAT via CDP commands. This is the pivotal moment where the malware gains programmatic control over the browser’s operations.

With control established, msaRAT opens a new, invisible browser tab. Into this tab, it injects custom JavaScript code. This injected script is the engine that drives the covert communication. It is meticulously crafted to construct a robust communication channel, crucially bypassing the browser’s built-in Content Security Policy (CSP). CSP is a security mechanism designed to prevent many types of injection attacks, so its circumvention is a significant technical achievement by the malware authors. Furthermore, the JavaScript registers specific CDP bindings, which are essentially custom commands that enable bidirectional communication between msaRAT and the browser’s underlying engine, facilitating the exchange of instructions and data.

The initial setup phase culminates in the browser, now under msaRAT’s control, initiating contact with a specific Cloudflare Workers endpoint. This endpoint, identified as is-01-ast[.]ols-img-12[.]workers[.]dev, serves as a crucial intermediary. Its role is to provide the necessary WebRTC (Web Real-Time Communication) connection information, which is then used by msaRAT to establish an encrypted channel.

H3: Multi-Layered Encryption and Evasion Tactics

Cisco Talos researchers have meticulously documented the sophisticated encryption mechanisms employed by msaRAT. The communication is fortified by not one, but two distinct layers of encryption. The first layer is the WebRTC DTLS (Datagram Transport Layer Security) protocol, which is an inherent security feature automatically provided by the browser’s WebRTC implementation. This provides a foundational level of encrypted communication.

On top of this, msaRAT implements its own custom encryption using the ChaCha20-Poly1305 cipher in conjunction with Elliptic Curve Diffie-Hellman (ECDH) key exchange. This dual-layer approach significantly enhances the confidentiality of the data being transmitted, making it exceedingly difficult for any eavesdropping attempts to succeed.

A key element of msaRAT’s evasion strategy involves the use of Twilio’s TURN (Traversal Using Relays around NAT) servers. TURN servers act as intermediaries in network communication, particularly when direct peer-to-peer connections are not feasible due to network address translation (NAT) or firewall restrictions. However, msaRAT’s implementation is specifically designed to avoid direct peer-to-peer connections.

"By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN," explained Cisco Talos in their report. This deliberate configuration ensures that all data traffic flows through Twilio’s infrastructure, rather than attempting a direct connection between the compromised endpoint and the attacker’s server.

The implications of this strategy are profound. By routing traffic through a legitimate and widely trusted service like Twilio, the true IP address of the attacker’s C2 server is never exposed in the network traffic. This makes it exceptionally difficult for network defenders to trace the malicious infrastructure. Furthermore, the combination of Twilio as a relay and Cloudflare Workers as the initial signaling point creates a complex, multi-layered architecture that is highly resistant to attribution and takedown efforts.

"By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Cisco Confidential Workers makes it significantly difficult to trace the attacker’s infrastructure," the researchers stated.

H3: Data Exchange and Infrastructure Obfuscation

The data exchange mechanism employed by msaRAT is also noteworthy. The researchers have documented how the malware breaks down communication messages into discrete chunks, referred to as "frames." These frames encapsulate various types of communication, including key exchanges for establishing encrypted sessions, commands for opening and closing communication channels, session reset signals, and critically, instructions for executing commands on the compromised Windows system.

The use of Cloudflare Workers as the signaling relay is a particularly cunning tactic. Cloudflare’s infrastructure is widely used and trusted, meaning that traffic directed to its servers is less likely to be flagged by firewalls or be subject to stringent allowlisting policies. The specific use of the "*workers.dev" free subdomain, often associated with legitimate developer deployments, further adds to the obfuscation. Blocking such a subdomain would not only impact malicious activity but also disrupt legitimate Cloudflare Workers services, creating a deterrent for overzealous blocking.

The fundamental advantage of msaRAT’s communication architecture is its ability to execute C2 exchanges without ever directly touching the network infrastructure controlled by the attacker. The traffic is effectively buried within what appears to be normal, legitimate web browsing activity, making it exceedingly difficult for security systems to differentiate between malicious and benign data flows.

H2: Broader Implications and Indicators of Compromise

The sophistication of msaRAT represents a significant evolution in the tactics employed by financially motivated cybercriminal groups. By leveraging legitimate services and protocols in such a novel way, attackers are increasingly able to evade traditional security measures. This necessitates a paradigm shift in how organizations approach network defense, moving beyond signature-based detection and focusing on behavioral analysis and anomaly detection.

The implications for incident response are also substantial. Tracing the origin of an attack that utilizes such robust obfuscation techniques requires advanced threat hunting capabilities and a deep understanding of the underlying network protocols and cloud infrastructure.

Cisco Talos, in their comprehensive report, has provided a crucial resource for security professionals by sharing a detailed list of Indicators of Compromise (IoCs) associated with msaRAT. These IoCs, which include network artifacts, file hashes, and other forensic clues, are essential for organizations to detect and respond to potential infections. The availability of these IoCs on GitHub allows security teams to proactively hunt for signs of compromise within their networks and update their security tools accordingly.

The continuous evolution of malware like msaRAT underscores the ongoing arms race between cybercriminals and cybersecurity defenders. The ability of groups like Chaos to develop and deploy such advanced tools highlights the need for constant vigilance, continuous security research, and the adoption of proactive defense strategies that can adapt to emerging threats. Organizations are urged to review their security postures, implement robust endpoint detection and response (EDR) solutions, and ensure their security teams are trained to identify and analyze complex, multi-layered attack vectors. The battle against sophisticated threats like msaRAT requires a layered defense that extends beyond perimeter security to encompass deep visibility into network traffic and endpoint behavior.