The Chaos ransomware group employs msaRAT, a Rust-based backdoor that uses Chrome or Edge browsers in headless mode to proxy C2 communications. It controls the browser through the Chrome DevTools Protocol, injecting JavaScript to build a communication channel that bypasses Content Security Policy restrictions. msaRAT connects to a Cloudflare Workers endpoint to obtain WebRTC signaling data and establishes an encrypted WebRTC channel routed exclusively through Twilio TURN servers, preventing direct peer-to-peer connections. This design conceals the attacker’s real IP and blends C2 traffic with legitimate web traffic, complicating detection and network tracing. The malware is loaded in memory from an MSI installer disguised as a Windows update, enabling stealthy persistence and operation.

The malware enables stealthy, persistent remote control of infected systems by hiding C2 traffic within legitimate browser processes and web traffic. This significantly reduces the likelihood of detection by network monitoring tools and firewalls. The use of legitimate cloud services (Cloudflare Workers and Twilio TURN) for signaling and relay further obscures attacker infrastructure. The infection vector involves social engineering and masquerading as legitimate Windows updates, increasing the risk of successful compromise. Once inside, attackers can execute commands and maintain persistence, facilitating further malicious activities such as ransomware deployment.

No official patch or fix is currently available for msaRAT malware. Mitigation focuses on detection and prevention through endpoint security solutions capable of identifying suspicious use of headless browsers and unusual Chrome DevTools Protocol activity. Organizations should be vigilant against phishing and social engineering attacks that deliver malicious MSI installers. Network defenders should monitor for anomalous WebRTC traffic patterns and connections to known malicious Cloudflare Workers and Twilio TURN endpoints. Blocking or restricting the use of headless browser automation in sensitive environments may reduce risk. Refer to Cisco Talos and Rapid7 advisories for updated IoCs and detection guidance.