# Chaos ransomware evades network detection with browser-based msaRAT A new ransomware variant uses Chrome and Edge browsers to bypass network monitoring tools. - **Source:** [Security Affairs](https://brifing.si/source/e6c4f5ec-3e1b-4152-a932-056243bd56eb) - **Published:** 2026-07-23 - **Original article:** - **On Brifing:** https://brifing.si/s/1cf18fbc-f665-4e1f-9517-114bd1814173 ## A New Threat: msaRAT Cisco Talos uncovered msaRAT, a new remote access trojan (RAT) attributed to the Chaos ransomware group. This malware routes its command-and-control (C2) traffic through Chrome or Edge browsers to evade network detection. Written in Rust, msaRAT never establishes direct network connections. ## Browser-Based Communication msaRAT conducts all communication via the Chrome DevTools Protocol (CDP), a debugging interface used by developers. The malware leverages legitimate services like Cloudflare Workers and Twilio to hide the attacker's server address in traffic. This method makes it harder for network monitoring tools to detect. ## Infection Process After gaining access to a Windows machine, msaRAT downloads an MSI file using curl. The file masquerades as a Windows update and loads the RAT DLL directly into memory. If no browser is found, the C2 channel cannot be established. When Chrome or Edge is detected, the browser launches in headless mode with remote debugging enabled. ## WebRTC and Encryption msaRAT communicates over WebRTC DataChannel, routing all traffic through Twilio's legitimate service. The communication is protected by double-layer encryption: DTLS and ChaCha-Poly1305. This enhances security and prevents man-in-the-middle attackers from reading the content. ## Detection Challenges Since all network communication occurs through the browser process, the malware itself never connects to the network. This poses a significant challenge for firewalls and network monitoring tools. Blocking the Cloudflare Workers domain could also disrupt legitimate Cloudflare deployments. ## Defensive Measures Cisco Talos has released ClamAV signatures and Snort rules to detect msaRAT. Network administrators should monitor browser processes launched with remote debugging flags and HeadlessChrome user-agent strings. Proactive measures against such threats are a critical part of cybersecurity strategies. ## Sources covering this story - https://securityaffairs.com/195876/malware/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._