The Chaos ransomware group has begun using a new trojan called msaRAT to hide its command-and-control communications inside legitimate connections made by Chrome and Edge browsers.
The malware was discovered on a compromised Windows system prior to the deployment of the ransomware encryptor. Written in Rust, msaRAT does not connect directly to the attackers' infrastructure. Instead, it starts a browser instance in invisible mode and controls it through the Chrome DevTools Protocol, ensuring that the process's network traffic remains limited to the local machine address.
The implant injects JavaScript code into the browser and uses a Cloudflare Workers service to negotiate a WebRTC connection. After negotiation, traffic is forwarded through Twilio TURN servers, preventing the real address of the attackers' servers from appearing in network logs. Received commands are executed via cmd.exe.
The malware also features queuing and flow-control mechanisms that support reliable transfer of files, screenshots, and other large data volumes. In the analyzed attack, operators downloaded an MSI installer presented as a Windows update. The package loaded a DLL containing msaRAT directly into memory, minimizing artifacts written to disk.
The technique does not exploit vulnerabilities in Chrome or Edge. Its goal is to make malicious traffic appear as normal browser activity and to leverage services that are widely permitted in corporate environments.
