The cybersecurity landscape has been introduced to a sophisticated new threat as the Chaos ransomware gang deploys a highly evasive backdoor known as msaRAT. This recently discovered malware distinguishes itself through a novel communication architecture that leverages legitimate web browsers, specifically Google Chrome and Microsoft Edge, to facilitate command-and-control (C2) traffic. By routing malicious data through these ubiquitous applications, the attackers have effectively obscured their footprint, making detection by traditional network security tools significantly more challenging.
Developed in the Rust programming language, msaRAT represents a growing trend of threat actors moving away from C or C++ toward modern languages that offer better memory safety and cross-platform capabilities, while also complicating reverse-engineering efforts for security researchers. The core of msaRAT’s functionality lies in its ability to manipulate the Chrome DevTools Protocol (CDP) to manage headless browser sessions, creating a stealthy bridge between the infected host and the attacker’s remote server.
The Evolution and Identity of the Chaos Ransomware Gang
The emergence of the current Chaos ransomware operation has caused some initial confusion within the cybersecurity community. While a ransomware family of the same name surfaced in 2021, researchers have confirmed that the group active in early 2025 is an entirely separate entity. This new iteration of Chaos has demonstrated a higher degree of technical sophistication and a more diverse set of operational objectives than its predecessor.
Historical context provided by researchers at Rapid7 earlier this year suggests that the Chaos identity has been utilized as a front for more complex geopolitical operations. Specifically, the Iranian state-backed hacking collective known as MuddyWater has been observed leveraging Chaos ransomware as a decoy. By deploying ransomware in what appear to be financially motivated attacks, these state-sponsored actors can disguise their true intent, which is often cyber-espionage and data exfiltration from strategic targets.
This dual-use nature of the Chaos brand complicates the attribution process for incident responders. Whether the current msaRAT campaign is purely criminal or part of a larger state-sponsored initiative remains a subject of ongoing investigation, but the level of infrastructure investment suggests a well-funded and highly organized operation.
Chronology of the msaRAT Infection Chain
The deployment of msaRAT is not a standalone event but the culmination of a multi-stage infection process documented by the Cisco Talos research team. The attack sequence typically begins with social engineering, utilizing either email-based phishing or voice-based phishing (vishing). In these initial stages, attackers masquerade as technical support or corporate administrators to gain a foothold in the victim’s environment.
Once the initial contact is successful, the attackers move to establish persistence. This is often achieved through the unauthorized installation of legitimate remote management and monitoring (RMM) software. By using tools that are common in corporate environments, the threat actors can move laterally within the network without triggering immediate alarms.
The final stage of the deployment involves the delivery of an MSI installer. To ensure the user or automated systems do not interfere, the installer is frequently disguised as a critical Windows update. When executed, this installer does not write the msaRAT binary to the disk in a traditional manner; instead, it loads the backdoor, identified as "lib.dll," directly into the system’s memory. This fileless execution technique is a hallmark of advanced persistent threats (APTs), as it leaves minimal traces for traditional antivirus solutions to scan.
Technical Analysis: Hijacking the Browser via CDP
The most distinctive feature of msaRAT is its interaction with local web browsers. Upon activation, the malware scans the host system for the presence of Google Chrome or Microsoft Edge. Once a compatible browser is located, msaRAT launches it in "headless mode." In this state, the browser runs as a background process without a graphical user interface, making it invisible to the casual observer or the victim.
Following the launch, msaRAT enables the browser’s remote debugging interface. This allows the malware to connect to the browser session using the Chrome DevTools Protocol (CDP). CDP is a powerful tool designed for developers to instrument, inspect, debug, and profile browsers, but in the hands of msaRAT, it becomes a weapon for session hijacking.
The malware uses CDP commands to open a new browser tab and inject custom JavaScript. This script is the engine for the C2 communication channel. It is programmed to bypass the browser’s Content Security Policy (CSP), a security layer designed to prevent cross-site scripting (XSS) and other data injection attacks. By registering specific CDP bindings, the malware creates a bidirectional communication link that the browser treats as legitimate web traffic.
Obfuscating the Network Footprint
To further evade detection, the msaRAT developers have implemented a complex network infrastructure that avoids direct connections to the attacker’s primary C2 server. The initial handshake occurs when the hijacked browser contacts a Cloudflare Workers endpoint. Cloudflare Workers is a serverless platform that allows developers to run code at the "edge" of the network. Because many legitimate enterprises use Cloudflare for their own operations, traffic to these endpoints is rarely blocked by firewalls or automated allowlists.
The Cloudflare Workers endpoint serves as a signaling relay. It provides the malware with the necessary information to establish a WebRTC connection. WebRTC (Web Real-Time Communication) is a protocol typically used for video conferencing and peer-to-peer data exchange in browsers. By using WebRTC, the malware can hide its data within a protocol that is common and expected in modern corporate environments.
The communication is further protected by two distinct layers of encryption. The first layer is the standard WebRTC DTLS (Datagram Transport Layer Security), which is handled automatically by the browser. The second layer is a custom implementation by the msaRAT developers, utilizing the ChaCha20-Poly1305 algorithm combined with an Elliptic Curve Diffie-Hellman (ECDH) key exchange. This ensures that even if the WebRTC tunnel is intercepted, the underlying commands remain encrypted.
To ensure the attacker’s IP address is never exposed, the traffic is relayed through Twilio TURN (Traversal Using Relays around NAT) servers. By intentionally omitting Interactive Connectivity Establishment (ICE) candidates that would normally allow for a direct peer-to-peer connection, the attackers force all traffic through the Twilio relay. This means that network logs will only show traffic between the victim’s browser and legitimate Twilio or Cloudflare IP addresses.
Supporting Data and Message Structure
Cisco Talos researchers provided a breakdown of the data exchange system, which operates through a series of "frames." These frames allow the attacker to manage the lifecycle of the backdoor and execute specific actions on the host machine. The documented frame types include:
- Key Exchange Frames: Facilitating the ECDH handshake to establish the secondary encryption layer.
- Channel Management Frames: Used for opening and closing communication channels or resetting sessions if a connection becomes unstable.
- Execution Frames: The primary payload delivery mechanism, allowing the attacker to send Windows commands to be executed via the hijacked browser’s context.
The use of the "*.workers.dev" subdomain is a strategic choice by the attackers. As a free tier offered by Cloudflare for developers, blocking this entire domain would result in significant collateral damage, potentially breaking numerous legitimate third-party services and internal corporate tools. This creates a "shield of legitimacy" that threat actors are increasingly exploiting.
Broader Impact and Security Implications
The discovery of msaRAT highlights a significant shift in how malware authors approach the problem of network visibility. By moving the C2 logic into the browser and using legitimate cloud infrastructure as a relay, the Chaos gang has bypassed many of the traditional indicators of compromise (IoCs) that security teams rely on.
The implications for enterprise security are profound. Traditional perimeter defenses, such as firewalls and Secure Web Gateways (SWGs), are often configured to trust traffic from major cloud providers like Cloudflare and Twilio. Furthermore, monitoring the behavior of headless browsers is not a standard practice in many Security Operations Centers (SOCs).
Security experts suggest that the rise of "browser-as-a-proxy" malware will require a shift toward behavior-based detection at the endpoint. Organizations are encouraged to monitor for unusual browser processes, particularly those launched with the --remote-debugging-port or --headless flags in environments where such activity is not part of the standard developer workflow.
Official Responses and Defensive Measures
Following the release of the Cisco Talos report, security vendors have begun updating their detection signatures to include the IoCs associated with msaRAT. This includes specific file hashes for the "lib.dll" component and the MSI installers, as well as the known Cloudflare Workers URLs used in the campaign.
However, researchers warn that relying on static IoCs may be insufficient, as the attackers can easily rotate their infrastructure and recompile their Rust-based malware to change its signature. Instead, the focus is shifting toward "Breach and Attack Simulation" (BAS) and improved EDR (Endpoint Detection and Response) rules.
Industry analysts note that security teams currently log only about 54% of successful attacks and alert on a mere 14%. The stealthy nature of msaRAT is designed specifically to fall into that gap of undetected activity. As threat actors continue to innovate with protocols like WebRTC and CDP, the defensive community must evolve to inspect the "gray areas" of legitimate web traffic that have previously been taken for granted.
In conclusion, msaRAT is a potent reminder of the ingenuity of modern ransomware groups. By blending into the noise of everyday web activity, the Chaos gang has raised the bar for what constitutes an "evasive" threat, necessitating a more granular and proactive approach to network and endpoint monitoring across the global cybersecurity ecosystem.
