Chaos ransomware evades network detection with browser-based msaRAT
A new ransomware variant uses Chrome and Edge browsers to bypass network monitoring tools.
1A New Threat: msaRAT
Cisco Talos uncovered msaRAT, a new remote access trojan (RAT) attributed to the Chaos ransomware group. This malware routes its command-and-control (C2) traffic through Chrome or Edge browsers to evade network detection. Written in Rust, msaRAT never establishes direct network connections.
2Browser-Based Communication
msaRAT conducts all communication via the Chrome DevTools Protocol (CDP), a debugging interface used by developers. The malware leverages legitimate services like Cloudflare Workers and Twilio to hide the attacker's server address in traffic. This method makes it harder for network monitoring tools to detect.
3Infection Process
After gaining access to a Windows machine, msaRAT downloads an MSI file using curl. The file masquerades as a Windows update and loads the RAT DLL directly into memory. If no browser is found, the C2 channel cannot be established. When Chrome or Edge is detected, the browser launches in headless mode with remote debugging enabled.
4WebRTC and Encryption
msaRAT communicates over WebRTC DataChannel, routing all traffic through Twilio's legitimate service. The communication is protected by double-layer encryption: DTLS and ChaCha-Poly1305. This enhances security and prevents man-in-the-middle attackers from reading the content.
5Detection Challenges
Since all network communication occurs through the browser process, the malware itself never connects to the network. This poses a significant challenge for firewalls and network monitoring tools. Blocking the Cloudflare Workers domain could also disrupt legitimate Cloudflare deployments.
6Defensive Measures
Cisco Talos has released ClamAV signatures and Snort rules to detect msaRAT. Network administrators should monitor browser processes launched with remote debugging flags and HeadlessChrome user-agent strings. Proactive measures against such threats are a critical part of cybersecurity strategies.