# Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel

> Cisco Talos identified msaRAT, a Rust-based remote-access tool used by the Chaos ransomware-as-a-service group that launches Chrome or Edge headlessly with remote debugging enabled, injects JavaScript via the Chrome DevTools Protocol, and pivots that access into a WebRTC data channel signaled through a Cloudflare Workers endpoint and relayed through a Twilio TURN server to conceal C2 traffic inside normal browser telemetry. It is delivered via an MSI installer masquerading as a Windows update and is used in the dwell-time window between initial compromise and ransomware deployment.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1656
- **ID:** TL-2026-1656
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Chaos
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

msaRAT is a Rust (Tokio async runtime) remote-access tool attributed to the Chaos ransomware-as-a-service group, first documented by Cisco Talos in July 2026. The intrusion begins with spam-email flooding and voice phishing (vishing) that lures victims into launching Microsoft Quick Assist or contacting fake IT support, giving the operators remote hands-on-keyboard access. Operators then retrieve `update_ms.msi` from `http://172.86.126.18:443/update_ms.msi` via `curl.exe` and execute it; the MSI's `CA_Run_EA2AEBC3` custom action fires on `InstallFinalize`, loading the embedded `Bin_lib_EA2AEBC3` binary (`lib.dll`, the msaRAT payload) directly into memory, bypassing on-disk executable defenses.

Once running, msaRAT enumerates the host for a Chrome or Edge installation (environment-variable paths first, then an `HKEY_LOCAL_MACHINE` registry fallback) and spawns the browser headlessly via `CreateProcessW` with `--remote-debugging-port=9222`. It then connects over a local WebSocket to the Chrome DevTools Protocol (CDP) endpoint at `127.0.0.1:9222`, issues `Page.setBypassCSP` to disable the page's Content Security Policy, registers five `Runtime.addBinding` callbacks (`msaOpen`, `msaClose`, `msaError`, `msaMessage`, `dataAck`), and injects JavaScript (stored in the malware's `.rdata` section) via `Runtime.evaluate`.

The injected JavaScript queries a Cloudflare Workers endpoint (`is-01-ast.ols-img-12.workers.dev`) with a spoofed Origin/Referer header impersonating a Microsoft domain to retrieve STUN (`stun2.l.google.com`) and TURN (`global.turn.twilio.com`) server details, then establishes a WebRTC RTCPeerConnection and DataChannel. The SDP answer returned by the Workers endpoint deliberately omits direct ICE candidates and sets the connection address to `0.0.0.0`, forcing 100% of C2 traffic through the Twilio TURN relay so the true C2 IP is never exposed to the victim browser. Data is Base64-encoded across the CDP `Runtime.bindingCalled` boundary, queued, and flushed once buffered data drops below 24KB. On top of WebRTC's own DTLS transport encryption, msaRAT layers ChaCha20-Poly1305 application encryption keyed via an ECDH handshake (a 0xFE handshake frame carrying the C2's public key, reciprocated by the implant to derive a shared secret) — a genuine double-encryption covert channel. Critically, the RAT process itself never touches the network directly; all egress is proxied through the already-whitelisted browser process, so defenders see what looks like ordinary Chrome/Edge web traffic rather than a malicious process making outbound connections.

msaRAT is a reconnaissance/access tool, not the ransomware payload itself — it is used to maintain covert C2 during the dwell-time window before Chaos affiliates deploy the group's C++ ransomware encryptor (`Encryptor.exe /lkey:<32-byte key> /encrypt_step:<percent> /work_mode:local_network`), which appends the `.chaos` extension, deletes shadow copies, and can operate cross-platform (Windows, ESXi, Linux, NAS).

Chaos RaaS itself emerged publicly in February 2025, shortly after the July 2025 law-enforcement takedown of BlackSuit (Operation Checkmate); Talos assesses with moderate confidence that Chaos is operated by former BlackSuit/Royal members based on shared ransom-note structure, matching CLI parameter naming (`/lkey`↔`-id`, `/encrypt_step`↔`-ep`, `/kill_vms`↔`-stopvm`), and overlapping RMM/LOLBin tradecraft. Operators recruit affiliates on the Russian-language Ransom Anonymous Market Place (RAMP) forum and explicitly avoid BRICS/CIS countries, hospitals, and government targets while double-extorting (encryption + leak-site disclosure) and threatening DDoS against non-paying victims; observed ransom demands have reached $300,000 USD.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1566 Phishing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1218 System Binary Proxy Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1547 Boot or Logon Autostart Execution
- T1133 External Remote Services
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1090 Proxy
- T1082 System Information Discovery
- T1518 Software Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1135 Network Share Discovery
- T1016 System Network Configuration Discovery
- T1482 Domain Trust Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1102 Web Service
- T1090 Proxy
- T1573 Encrypted Channel
- T1132 Data Encoding
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [Chaos msaRAT: Living Off the Browser to Build a Covert C2 Channel](https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/)
- [Chaos Ransomware Turns Chrome Into Malware Delivery Tool](https://cybersecuritynews.com/chaos-ransomware-turns-chrome-malware/)
- [Unmasking the new Chaos RaaS group attacks](https://blog.talosintelligence.com/new-chaos-ransomware/)
- [Chaos RaaS Emerges After BlackSuit Takedown, Demanding $300K from U.S. Victims](https://thehackernews.com/2025/07/chaos-raas-emerges-after-blacksuit.html)
- [New Chaos ransomware group linked to BlackSuit amid site seizures](https://www.scworld.com/news/new-chaos-ransomware-group-linked-to-blacksuit-amid-site-seizures)
- [Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities](https://securityboulevard.com/2026/07/chaos-ransomware-blacksuit-linked-raas-resurgence-and-detection-opportunities/)
- [Cisco Talos IOC repository — chaos-msarat.txt](https://github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt)
- [Chaos Ransomware: RaaS Resurgence & Detection](https://www.attackiq.com/2026/07/16/chaos-ransomware/)
- [CHAOS in a BLACKSUIT: Triple Extortion Ransomware](https://www.extrahop.com/blog/chaos-in-a-blacksuit-triple-extortion-ransomware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1656