Chaos Ransomware Routes C2 Traffic Through Headless Browsers
New msaRAT implant uses victim's browser as covert command channel.
1Stealthy Browser-Based C2
The Chaos ransomware group leverages Rust-based msaRAT implant to route command-and-control traffic through victims' Chrome/Edge browsers in headless mode. Using Chrome DevTools Protocol (CDP), the malware establishes WebRTC channels relayed via Twilio's TURN service, making network traffic appear as legitimate browser connections to Cloudflare and Twilio endpoints.
2Technical Execution
msaRAT locates browsers via environment variables/registry, launches them with --headless=new flag, and hijacks CDP communication. It injects JavaScript to fetch STUN/TURN config from a Cloudflare Worker. Traffic undergoes dual encryption (DTLS + ChaCha-Poly1305) with keys exchanged via ECDH after initial 0xFE handshake frame.
3Deployment Mechanism
The payload deploys via simple curl download from http://172.86.126.18:443 as fake Windows update (update_ms.msi). The MSI executes embedded DLL containing msaRAT - a Rust implant built on Tokio async runtime, activated through exported RUN function. This lightweight delivery bypasses protocol inspection-focused firewalls.
4Detection Challenges
Since the technique exploits browser features rather than vulnerabilities, no patch exists. Defenders must monitor process behavior: headless browsers spawned by installers/services, loopback traffic to debug ports, and WebRTC connections. Runtime.addBinding and Runtime.evaluate CDP messages serve as critical pivots in forensic analysis.
5Limited IOC Effectiveness
Published IOCs (172.86.126.18 and workers.dev subdomain) offer narrow visibility. workers.dev is Cloudflare's shared domain for all Worker accounts, while Twilio's TURN service supports legitimate WebRTC apps. Blocking these would cause widespread collateral damage, illustrating attackers' strategic abuse of trusted infrastructure.
6Broader Implications
This evolution demonstrates ransomware operators' increasing sophistication in blending with normal traffic. The abuse of legitimate cloud services necessitates reevaluation of traditional network monitoring approaches. Organizations using browser automation must enhance logging to distinguish between legitimate and malicious headless instances.