Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel — Threadlinqs Intelligence
As of 2026-07-23, Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel is a high-severity malware threat attributed to Chaos, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1656 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Chaos · FINANCIAL
Cisco Talos identified msaRAT, a Rust-based remote-access tool used by the Chaos ransomware-as-a-service group that launches Chrome or Edge headlessly with remote debugging enabled, injects JavaScript
msaRAT is a Rust (Tokio async runtime) remote-access tool attributed to the Chaos ransomware-as-a-service group, first documented by Cisco Talos in July 2026. The intrusion begins with spam-email flooding and voice phishing (vishing) that lures victims into launching Microsoft Quick Assist or contacting fake IT support, giving the operators remote hands-on-keyboard access. Operators then retrieve `update_ms.msi` from `http://172.86.126.18:443/update_ms.msi` via `curl.exe` and execute it; the MSI's `CA_Run_EA2AEBC3` custom action fires on `InstallFinalize`, loading the embedded `Bin_lib_EA2AEBC3` binary (`lib.dll`, the msaRAT payload) directly into memory, bypassing on-disk executable defenses.
Once running, msaRAT enumerates the host for a Chrome or Edge installation (environment-variable paths first, then an `HKEY_LOCAL_MACHINE` registry fallback) and spawns the browser headlessly via `CreateProcessW` with `--remote-debugging-port=9222`. It then connects over a local WebSocket to the Chrome DevTools Protocol (CDP) endpoint at `127.0.0.1:9222`, issues `Page.setBypassCSP` to disable the page's Content Security Policy, registers five `Runtime.addBinding` callbacks (`msaOpen`, `msaClose`, `msaError`, `msaMessage`, `dataAck`), and injects JavaScript (stored in the malware's `.rdata` section) via `Runtime.evaluate`.
The injected JavaScript queries a Cloudflare Workers endpoint (`is-01-ast.ols-img-12.workers.dev`) with a spoofed Origin/Referer header impersonating a Microsoft domain to retrieve STUN (`stun2.l.google.com`) and TURN (`global.turn.twilio.com`) server details, then establishes a WebRTC RTCPeerConnection and DataChannel. The SDP answer returned by the Workers endpoint deliberately omits direct ICE candidates and sets the connection address to `0.0.0.0`, forcing 100% of C2 traffic through the Twilio TURN relay so the true C2 IP is never exposed to the victim browser. Data is Base64-encoded across the CDP `Runtime.bindingCalled` boundary, queued, and flushed once buffered data drops below 24KB. On top of WebRTC's own DTLS transport encryption, msaRAT layers ChaCha20-Poly1305 application encryption keyed via an ECDH handshake (a 0xFE handshake frame carrying the C2's public key, reciprocated by the implant to derive a shared secret) — a genuine double-encryption covert channel. Critically, the RAT process itself never touches the network directly; all egress is proxied through the already-whitelisted browser process, so defenders see what looks like ordinary Chrome/Edge web traffic rather than a malicious process making outbound connections.
msaRAT is a reconnaissance/access tool, not the ransomware payload itself — it is used to maintain covert C2 during the dwell-time window before Chaos affiliates deploy the group's C++ ransomware encryptor (`Encryptor.exe /lkey:<32-byte key> /encrypt_step:<percent> /work_mode:local_network`), which appends the `.chaos` extension, deletes shadow copies, and can operate cross-platform (Windows, ESXi, Linux, NAS).
Chaos RaaS itself emerged publicly in February 2025, shortly after the July 2025 law-enforcement takedown of BlackSuit (Operation Checkmate); Talos assesses with moderate confidence that Chaos is operated by former BlackSuit/Royal members based on shared ransom-note structure, matching CLI parameter naming (`/lkey`↔`-id`, `/encrypt_step`↔`-ep`, `/kill_vms`↔`-stopvm`), and overlapping RMM/LOLBin tradecraft. Operators recruit affiliates on the Russian-language Ransom Anonymous Market Place (RAMP) forum and explicitly avoid BRICS/CIS countries, hospitals, and government targets while double-extorting (encryption + leak-site disclosure) and threatening DDoS against non-paying victims; observed ransom demands have reached $300,000 USD.
Target sectors: cross-sector, large-enterprise
Target regions: united states of america, united kingdom, new zealand, india
Detections & IOCs
As of 2026-07-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1598, T1566, T1133, T1078, T1218, T1059, T1059, T1047, T1547, T1133