Threat reportMalwareTL-2026-1656
Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel
Chaos Ransomware Group Deploys msaRAT (TL-2026-1656), also tracked as msaRAT, is a high-severity malware campaign, first published 2026-07-23. It is attributed to Chaos with medium confidence, affects Google Chrome, maps to 36 MITRE ATT&CK techniques (T1005, T1008, T1016), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 36MITRE ATT&CK
- Actors
- 1Chaos
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-1656
- Threat ID
- TL-2026-1656
- Also known as
- msaRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Chaos
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, large-enterprise
- Target regions
- united states of america, united kingdom, new zealand, india
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Chaos Ransomware Group Deploys msaRAT
Malware and tooling: Chaos ransomware, msaRAT, AnyDesk, GoodSync, Impacket - S0357, Microsoft Quick Assist, ScreenConnect
How Chaos Ransomware Group Deploys msaRAT works
Cisco Talos identified msaRAT, a Rust-based remote-access tool used by the Chaos ransomware-as-a-service group that launches Chrome or Edge headlessly with remote debugging enabled, injects JavaScript via the Chrome DevTools Protocol, and pivots that access into a WebRTC data channel signaled through a Cloudflare Workers endpoint and relayed through a Twilio TURN server to conceal C2 traffic inside normal browser telemetry. It is delivered via an MSI installer masquerading as a Windows update and is used in the dwell-time window between initial compromise and ransomware deployment.
msaRAT is a Rust (Tokio async runtime) remote-access tool attributed to the Chaos ransomware-as-a-service group, first documented by Cisco Talos in July 2026. The intrusion begins with spam-email flooding and voice phishing (vishing) that lures victims into launching Microsoft Quick Assist or contacting fake IT support, giving the operators remote hands-on-keyboard access. Operators then retrieve `update_ms.msi` from `http://172.86.126.18:443/update_ms.msi` via `curl.exe` and execute it; the MSI's `CA_Run_EA2AEBC3` custom action fires on `InstallFinalize`, loading the embedded `Bin_lib_EA2AEBC3` binary (`lib.dll`, the msaRAT payload) directly into memory, bypassing on-disk executable defenses.
Once running, msaRAT enumerates the host for a Chrome or Edge installation (environment-variable paths first, then an `HKEY_LOCAL_MACHINE` registry fallback) and spawns the browser headlessly via `CreateProcessW` with `--remote-debugging-port=9222`. It then connects over a local WebSocket to the Chrome DevTools Protocol (CDP) endpoint at `127.0.0.1:9222`, issues `Page.setBypassCSP` to disable the page's Content Security Policy, registers five `Runtime.addBinding` callbacks (`msaOpen`, `msaClose`, `msaError`, `msaMessage`, `dataAck`), and injects JavaScript (stored in the malware's `.rdata` section) via `Runtime.evaluate`.
The injected JavaScript queries a Cloudflare Workers endpoint (`is-01-ast.ols-img-12.workers.dev`) with a spoofed Origin/Referer header impersonating a Microsoft domain to retrieve STUN (`stun2.l.google.com`) and TURN (`global.turn.twilio.com`) server details, then establishes a WebRTC RTCPeerConnection and DataChannel. The SDP answer returned by the Workers endpoint deliberately omits direct ICE candidates and sets the connection address to `0.0.0.0`, forcing 100% of C2 traffic through the Twilio TURN relay so the true C2 IP is never exposed to the victim browser. Data is Base64-encoded across the CDP `Runtime.bindingCalled` boundary, queued, and flushed once buffered data drops below 24KB. On top of WebRTC's own DTLS transport encryption, msaRAT layers ChaCha20-Poly1305 application encryption keyed via an ECDH handshake (a 0xFE handshake frame carrying the C2's public key, reciprocated by the implant to derive a shared secret) — a genuine double-encryption covert channel. Critically, the RAT process itself never touches the network directly; all egress is proxied through the already-whitelisted browser process, so defenders see what looks like ordinary Chrome/Edge web traffic rather than a malicious process making outbound connections.
msaRAT is a reconnaissance/access tool, not the ransomware payload itself — it is used to maintain covert C2 during the dwell-time window before Chaos affiliates deploy the group's C++ ransomware encryptor (`Encryptor.exe /lkey:<32-byte key> /encrypt_step:<percent> /work_mode:local_network`), which appends the `.chaos` extension, deletes shadow copies, and can operate cross-platform (Windows, ESXi, Linux, NAS).
Chaos RaaS itself emerged publicly in February 2025, shortly after the July 2025 law-enforcement takedown of BlackSuit (Operation Checkmate); Talos assesses with moderate confidence that Chaos is operated by former BlackSuit/Royal members based on shared ransom-note structure, matching CLI parameter naming (`/lkey`↔`-id`, `/encrypt_step`↔`-ep`, `/kill_vms`↔`-stopvm`), and overlapping RMM/LOLBin tradecraft. Operators recruit affiliates on the Russian-language Ransom Anonymous Market Place (RAMP) forum and explicitly avoid BRICS/CIS countries, hospitals, and government targets while double-extorting (encryption + leak-site disclosure) and threatening DDoS against non-paying victims; observed ransom demands have reached $300,000 USD.
MITRE ATT&CK techniques used in TL-2026-1656
Collection
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel
Discovery
T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518 Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing
command-and-control
Persistence
T1133 External Remote Services; T1547 Boot or Logon Autostart Execution
stealth
T1218 System Binary Proxy Execution
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Reconnaissance
T1598 Phishing for Information
defense-impairment
Affected products and versions in Chaos Ransomware Group Deploys msaRAT
- Google — Chrome
Vulnerable versions: any version supporting Chrome DevTools Protocol remote debugging - Microsoft — Edge
Vulnerable versions: any Chromium-based version supporting remote debugging - Microsoft — Windows
Vulnerable versions: all supported versions (delivery via MSI installer, no OS-specific vulnerability exploited)
Remediation for Chaos Ransomware Group Deploys msaRAT
Immediate actions
- Block outbound connections to 172.86.126.18 and the Cloudflare Workers hostname is-01-ast.ols-img-12.workers.dev at perimeter/proxy
- Deploy the supplied ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0, Win.Ransomware.Chaos-10045485-0) and Snort SIDs (1:66839, 1:66840, 1:66841, 1:301587, 1:65125, 1:65126, 1:301273)
- Hunt for chrome.exe/msedge.exe child processes launched with --remote-debugging-port or --headless flags, especially spawned by msiexec.exe or non-browser parents
- Hunt for MSI installs invoking non-standard custom actions (CA_Run_* / Bin_* naming patterns) via InstallFinalize
- Alert on WebRTC/STUN/TURN network flows (UDP 3478/5349, or DTLS-wrapped TURN-relayed streams) originating from browser processes on endpoints with no legitimate video/conferencing use case
- Isolate and forensically image any host with update_ms.msi or lib.dll present in C:\ProgramData
Workarounds
- Where remote debugging cannot be disabled, restrict Chrome/Edge to run under a policy that blocks --remote-debugging-port entirely for standard users
- Network-segment endpoints from directly reaching third-party TURN/STUN infrastructure (Twilio, Google) if not business-required
Longer-term hardening
- Restrict or disable Chrome/Edge remote-debugging capability via GPO/browser policy (RemoteDebuggingAllowed=false) on non-developer endpoints
- Deploy EDR/browser-telemetry correlation to flag DevTools Protocol WebSocket connections to 127.0.0.1 from non-developer tooling
- Disable or tightly restrict Microsoft Quick Assist and other unmanaged remote-access tools (AnyDesk, ScreenConnect, Splashtop) via application allowlisting
- Implement DNS/TLS inspection or SNI-based blocking for anomalous *.workers.dev subdomains not on an approved allowlist
- Harden phishing/vishing resilience: caller-verification procedures for IT helpdesk requests, email-bombing detection and auto-throttling
Timeline of Chaos Ransomware Group Deploys msaRAT
- Chaos ransomware-as-a-service group publicly emerges shortly after the July 2025 law-enforcement disruption (Operation Checkmate) of BlackSuit infrastructure; Talos assesses moderate confidence it is operated by former BlackSuit/Royal members
- Earliest known Chaos ransomware encryptor samples compiled (February 2025 compile-timestamp cluster)
- Additional Chaos ransomware encryptor samples compiled (March 2025 compile-timestamp cluster)
- Additional Chaos ransomware encryptor samples compiled (May 2025 compile-timestamp cluster)
- Cisco Talos and multiple outlets (TheHackerNews, SC Media) publicly profile the new Chaos RaaS group, its RAMP-forum recruitment, and BlackSuit/Royal tooling overlaps; observed ransom demands reaching $300,000 USD
- AttackIQ publishes Chaos ransomware RaaS resurgence and detection-opportunities research
- Cisco Talos publishes msaRAT IOCs (C2 IP 172.86.126.18, Cloudflare Workers domain is-01-ast.ols-img-12.workers.dev) to its public GitHub IOC repository alongside ClamAV and Snort detection content
- Cyber Security News republishes and summarizes the Talos msaRAT findings, driving broader visibility of the technique
- Cisco Talos publishes technical analysis of msaRAT, documenting the Chrome/Edge DevTools Protocol + WebRTC + Cloudflare Workers/TURN covert C2 channel used by Chaos affiliates between initial compromise and ransomware deployment
Sources cited for Chaos Ransomware Group Deploys msaRAT
- Chaos msaRAT: Living Off the Browser to Build a Covert C2 Channel
- Chaos Ransomware Turns Chrome Into Malware Delivery Tool
- Unmasking the new Chaos RaaS group attacks
- Chaos RaaS Emerges After BlackSuit Takedown, Demanding $300K from U.S. Victims
- New Chaos ransomware group linked to BlackSuit amid site seizures
- Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities
- Cisco Talos IOC repository — chaos-msarat.txt
- Chaos Ransomware: RaaS Resurgence & Detection
- CHAOS in a BLACKSUIT: Triple Extortion Ransomware
Detection coverage for TL-2026-1656
As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1656 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.