Chaos

Cybercriminals Distribute NJRAT, DCRAT and Chaos via Fake GTA 6 Downloads

Threat actors are leveraging anticipation around GTA 6 to spread multiple malware families through fake game downloads. Security researchers at Huntress identified campaigns that combine search-engine poisoning, gaming forums, torrent sites and social-media posts to deliver oversized fake ISO files exceeding 100 GB. Victims who execute the installer see Russian-language messages claiming an invalid crack or missing license, while remote-access tools and data stealers run silently in the background. The delivered payloads include NJRAT and DCRAT for keystroke logging, screen capture and webcam access, Mercurial Grabber for harvesting browser credentials and Discord tokens, and the Chaos wiper that encrypts small files and overwrites larger ones. The operation primarily targets Russian-speaking gamers, as indicated by the ransom note and error messages. Analysts recommend avoiding unofficial downloads and isolating any compromised systems immediately.

Chaos Ransomware Group Uses msaRAT Trojan to Hide C2 Traffic Through Invisible Chrome and Edge Browsers

The Chaos ransomware group has adopted a new Rust-based trojan called msaRAT to conceal its command-and-control communications inside legitimate browser sessions. The malware launches Chrome or Edge in invisible mode and controls it via the Chrome DevTools Protocol, keeping all outbound traffic restricted to localhost. It then injects JavaScript to negotiate a WebRTC connection through Cloudflare Workers before routing data over Twilio TURN servers, preventing the attackers' real infrastructure from appearing in network logs. Commands are executed through cmd.exe, and the implant includes queuing mechanisms that support reliable transfer of files, screenshots, and larger data volumes. In the analyzed incident, operators delivered the malware via an MSI installer disguised as a Windows update that loaded the msaRAT DLL directly into memory. The technique does not exploit any vulnerabilities in Chrome or Edge and is designed to blend malicious traffic with normal corporate browser activity.