Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel

Chaos Ransomware Group Deploys msaRAT (TL-2026-1656), also tracked as msaRAT, is a high-severity malware campaign, first published 2026-07-23. It is attributed to Chaos with medium confidence, affects Google Chrome, maps to 36 MITRE ATT&CK techniques (T1005, T1008, T1016), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1656

Threat ID
TL-2026-1656
Also known as
msaRAT
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-23
Last reviewed
2026-07-23
Attribution
Chaos
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
cross-sector, large-enterprise
Target regions
united states of america, united kingdom, new zealand, india
Detection rules
9
Indicators of compromise
28

Malware and tooling in Chaos Ransomware Group Deploys msaRAT

Malware and tooling: Chaos ransomware, msaRAT, AnyDesk, GoodSync, Impacket - S0357, Microsoft Quick Assist, ScreenConnect

Cisco Talos identified msaRAT, a Rust-based remote-access tool used by the Chaos ransomware-as-a-service group that launches Chrome or Edge headlessly with remote debugging enabled, injects JavaScript via the Chrome DevTools Protocol, and pivots that access into a WebRTC data channel signaled through a Cloudflare Workers endpoint and relayed through a Twilio TURN server to conceal C2 traffic inside normal browser telemetry. It is delivered via an MSI installer masquerading as a Windows update and is used in the dwell-time window between initial compromise and ransomware deployment.

How Chaos Ransomware Group Deploys msaRAT works

msaRAT is a Rust (Tokio async runtime) remote-access tool attributed to the Chaos ransomware-as-a-service group, first documented by Cisco Talos in July 2026. The intrusion begins with spam-email flooding and voice phishing (vishing) that lures victims into launching Microsoft Quick Assist or contacting fake IT support, giving the operators remote hands-on-keyboard access. Operators then retrieve `update_ms.msi` from `http://172.86.126.18:443/update_ms.msi` via `curl.exe` and execute it; the MSI's `CA_Run_EA2AEBC3` custom action fires on `InstallFinalize`, loading the embedded `Bin_lib_EA2AEBC3` binary (`lib.dll`, the msaRAT payload) directly into memory, bypassing on-disk executable defenses.

Once running, msaRAT enumerates the host for a Chrome or Edge installation (environment-variable paths first, then an `HKEY_LOCAL_MACHINE` registry fallback) and spawns the browser headlessly via `CreateProcessW` with `--remote-debugging-port=9222`. It then connects over a local WebSocket to the Chrome DevTools Protocol (CDP) endpoint at `127.0.0.1:9222`, issues `Page.setBypassCSP` to disable the page's Content Security Policy, registers five `Runtime.addBinding` callbacks (`msaOpen`, `msaClose`, `msaError`, `msaMessage`, `dataAck`), and injects JavaScript (stored in the malware's `.rdata` section) via `Runtime.evaluate`.

The injected JavaScript queries a Cloudflare Workers endpoint (`is-01-ast.ols-img-12.workers.dev`) with a spoofed Origin/Referer header impersonating a Microsoft domain to retrieve STUN (`stun2.l.google.com`) and TURN (`global.turn.twilio.com`) server details, then establishes a WebRTC RTCPeerConnection and DataChannel. The SDP answer returned by the Workers endpoint deliberately omits direct ICE candidates and sets the connection address to `0.0.0.0`, forcing 100% of C2 traffic through the Twilio TURN relay so the true C2 IP is never exposed to the victim browser. Data is Base64-encoded across the CDP `Runtime.bindingCalled` boundary, queued, and flushed once buffered data drops below 24KB. On top of WebRTC's own DTLS transport encryption, msaRAT layers ChaCha20-Poly1305 application encryption keyed via an ECDH handshake (a 0xFE handshake frame carrying the C2's public key, reciprocated by the implant to derive a shared secret) — a genuine double-encryption covert channel. Critically, the RAT process itself never touches the network directly; all egress is proxied through the already-whitelisted browser process, so defenders see what looks like ordinary Chrome/Edge web traffic rather than a malicious process making outbound connections.

msaRAT is a reconnaissance/access tool, not the ransomware payload itself — it is used to maintain covert C2 during the dwell-time window before Chaos affiliates deploy the group's C++ ransomware encryptor (`Encryptor.exe /lkey:<32-byte key> /encrypt_step:<percent> /work_mode:local_network`), which appends the `.chaos` extension, deletes shadow copies, and can operate cross-platform (Windows, ESXi, Linux, NAS).

Chaos RaaS itself emerged publicly in February 2025, shortly after the July 2025 law-enforcement takedown of BlackSuit (Operation Checkmate); Talos assesses with moderate confidence that Chaos is operated by former BlackSuit/Royal members based on shared ransom-note structure, matching CLI parameter naming (`/lkey`↔`-id`, `/encrypt_step`↔`-ep`, `/kill_vms`↔`-stopvm`), and overlapping RMM/LOLBin tradecraft. Operators recruit affiliates on the Russian-language Ransom Anonymous Market Place (RAMP) forum and explicitly avoid BRICS/CIS countries, hospitals, and government targets while double-extorting (encryption + leak-site disclosure) and threatening DDoS against non-paying victims; observed ransom demands have reached $300,000 USD.

MITRE ATT&CK techniques used in TL-2026-1656

Collection

T1005 Data from Local System

Command and Control

T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518 Software Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing

command-and-control

T1090 Proxy

Persistence

T1133 External Remote Services; T1547 Boot or Logon Autostart Execution

stealth

T1218 System Binary Proxy Execution

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft

Reconnaissance

T1598 Phishing for Information

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Chaos Ransomware Group Deploys msaRAT

  • Google — Chrome
    Vulnerable versions: any version supporting Chrome DevTools Protocol remote debugging
  • Microsoft — Edge
    Vulnerable versions: any Chromium-based version supporting remote debugging
  • Microsoft — Windows
    Vulnerable versions: all supported versions (delivery via MSI installer, no OS-specific vulnerability exploited)

Remediation for Chaos Ransomware Group Deploys msaRAT

Immediate actions

  • Block outbound connections to 172.86.126.18 and the Cloudflare Workers hostname is-01-ast.ols-img-12.workers.dev at perimeter/proxy
  • Deploy the supplied ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0, Win.Ransomware.Chaos-10045485-0) and Snort SIDs (1:66839, 1:66840, 1:66841, 1:301587, 1:65125, 1:65126, 1:301273)
  • Hunt for chrome.exe/msedge.exe child processes launched with --remote-debugging-port or --headless flags, especially spawned by msiexec.exe or non-browser parents
  • Hunt for MSI installs invoking non-standard custom actions (CA_Run_* / Bin_* naming patterns) via InstallFinalize
  • Alert on WebRTC/STUN/TURN network flows (UDP 3478/5349, or DTLS-wrapped TURN-relayed streams) originating from browser processes on endpoints with no legitimate video/conferencing use case
  • Isolate and forensically image any host with update_ms.msi or lib.dll present in C:\ProgramData

Workarounds

  • Where remote debugging cannot be disabled, restrict Chrome/Edge to run under a policy that blocks --remote-debugging-port entirely for standard users
  • Network-segment endpoints from directly reaching third-party TURN/STUN infrastructure (Twilio, Google) if not business-required

Longer-term hardening

  • Restrict or disable Chrome/Edge remote-debugging capability via GPO/browser policy (RemoteDebuggingAllowed=false) on non-developer endpoints
  • Deploy EDR/browser-telemetry correlation to flag DevTools Protocol WebSocket connections to 127.0.0.1 from non-developer tooling
  • Disable or tightly restrict Microsoft Quick Assist and other unmanaged remote-access tools (AnyDesk, ScreenConnect, Splashtop) via application allowlisting
  • Implement DNS/TLS inspection or SNI-based blocking for anomalous *.workers.dev subdomains not on an approved allowlist
  • Harden phishing/vishing resilience: caller-verification procedures for IT helpdesk requests, email-bombing detection and auto-throttling

Timeline of Chaos Ransomware Group Deploys msaRAT

  • Chaos ransomware-as-a-service group publicly emerges shortly after the July 2025 law-enforcement disruption (Operation Checkmate) of BlackSuit infrastructure; Talos assesses moderate confidence it is operated by former BlackSuit/Royal members
  • Earliest known Chaos ransomware encryptor samples compiled (February 2025 compile-timestamp cluster)
  • Additional Chaos ransomware encryptor samples compiled (March 2025 compile-timestamp cluster)
  • Additional Chaos ransomware encryptor samples compiled (May 2025 compile-timestamp cluster)
  • Cisco Talos and multiple outlets (TheHackerNews, SC Media) publicly profile the new Chaos RaaS group, its RAMP-forum recruitment, and BlackSuit/Royal tooling overlaps; observed ransom demands reaching $300,000 USD
  • AttackIQ publishes Chaos ransomware RaaS resurgence and detection-opportunities research
  • Cisco Talos publishes msaRAT IOCs (C2 IP 172.86.126.18, Cloudflare Workers domain is-01-ast.ols-img-12.workers.dev) to its public GitHub IOC repository alongside ClamAV and Snort detection content
  • Cyber Security News republishes and summarizes the Talos msaRAT findings, driving broader visibility of the technique
  • Cisco Talos publishes technical analysis of msaRAT, documenting the Chrome/Edge DevTools Protocol + WebRTC + Cloudflare Workers/TURN covert C2 channel used by Chaos affiliates between initial compromise and ransomware deployment

Sources cited for Chaos Ransomware Group Deploys msaRAT

Threats related to Chaos Ransomware Group Deploys msaRAT

Detection coverage for TL-2026-1656

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1656 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats