On July 23, 2026, Cisco Talos published research on msaRAT, a newly identified Rust-based remote access trojan attributed to the Chaos ransomware-as-a-service (RaaS) group, which Talos assesses with moderate confidence is a rebrand or continuation led by former members of the BlackSuit (Royal) ransomware operation. Chaos has been active since at least February 2025, advertising on the Russian-language forum RAMP (Ransom Anon Market Place), and was separately linked in mid-2025 to the Iranian state-sponsored MuddyWater (Seedworm) APT, which Talos assesses used the Chaos brand as cover for espionage operations tied to a specific code-signing certificate and shared C2 infrastructure.

In the campaign documented here, initial access follows Chaos's established pattern: spam email flooding followed by voice-based social engineering (vishing) in which operators impersonate IT/security staff and coax victims into activating Microsoft Quick Assist for remote-control access. Once a foothold is established, operators deploy commercial remote monitoring and management (RMM) tools -- AnyDesk, ScreenConnect, OptiTune, Syncro RMM, and Splashtop -- for durable remote access, and pivot into the environment via RDP, SMB/Windows Admin Shares, and SSH, using the Impacket toolkit for remote command execution and reverse SSH tunnels to command infrastructure (observed example: 45.61.134.36:443).

The distinguishing element of this campaign is msaRAT, delivered via a curl download of an MSI installer (update_ms.msi, staged from 172.86.126.18 over port 443) disguised as a Windows update. The MSI's custom action (CA_Run_EA2AEBC3) loads the RAT payload (lib.dll) directly into memory from the MSI's embedded Binary table, avoiding a dropped executable. msaRAT is built on the Rust Tokio async runtime and is architected around a hard design constraint: the RAT process itself never touches the network -- all outbound traffic (127.0.0.1 loopback only from the RAT process) is instead relayed through a headless instance of the victim's own Chrome or Edge browser, located via environment-variable probing and registry fallback, and launched with remote debugging enabled on port 9222.

msaRAT drives the browser purely through Chrome DevTools Protocol (CDP) calls: Target.createTarget to spin up a hidden tab, Page.enable/Runtime.enable to activate a JS execution context, Page.setBypassCSP to disable Content-Security-Policy restrictions that would otherwise block the injected logic, Runtime.addBinding to register five JS-to-native callback bindings (msaOpen, msaClose, msaError, msaMessage, dataAck -- the source of the RAT's name), and Runtime.evaluate to inject the JavaScript that performs the actual WebRTC signaling and data-channel handling inside the browser's own JS engine. Because the browser, not the RAT, originates every packet, the campaign evades network monitoring built around process-to-network attribution.

Signaling is handled by a Cloudflare Workers endpoint (is-01-ast.ols-img-12.workers.dev) which the injected browser JS queries via HTTPS GET (with Origin/Referer headers spoofed to resemble Microsoft traffic) to retrieve STUN/TURN configuration. The browser then performs a STUN request to a legitimate Google STUN server (stun2.l.google.com) and establishes a WebRTC RTCPeerConnection whose actual media path is forced through Twilio's TURN relay infrastructure (global.turn.twilio.com): the Cloudflare Workers signaling response intentionally omits ICE candidates and sets the connection address to 0.0.0.0, which prevents any direct peer-to-peer path and guarantees all C2 traffic is relayed via Twilio, hiding the true C2 server IP entirely from the victim's network telemetry. A DataChannel with a randomized 5-20 character alphanumeric label is then negotiated via SDP Offer/Answer exchange (POST to the Workers signaling endpoint).

On top of the browser-native DTLS transport encryption, msaRAT layers application-level encryption: the C2 sends a Handshake frame (opcode 0xFE) containing an ECDH public key, the RAT generates its own ephemeral key pair, derives a shared secret, and encrypts/decrypts all subsequent frames with ChaCha20-Poly1305 using that derived key -- defeating passive and even active (TLS-terminating) network inspection since the payload is encrypted a second time before ever reaching the browser's transport layer. Commands are processed through a two-layer state machine: an outer layer tracking connection state (Handshake, Ready, etc.) and an inner layer dispatching individual command frames, consistent with a full interactive remote-access capability set typical of Rust-based RATs (shell execution, file transfer, and system reconnaissance), though Talos's public writeup did not enumerate every inner-frame opcode.

Once ransomware deployment is triggered, Chaos's encryptor uses hybrid cryptography: ECDH (Curve25519) to negotiate per-file/session keys and AES-256 (CFB mode observed, with RSA-1024 key wrapping per detection-engineering writeups) to encrypt file contents, appending a .chaos extension with a 60-byte metadata header. The encryptor supports a configurable encrypt_step parameter (default 30%, partial/selective encryption to speed up large-scale runs), and local/network/combined work modes (invoked e.g. Encryptor.exe /lkey:"<32-byte key>" /encrypt_step:40 /work_mode:local_network). Before encryption, the malware performs anti-analysis checks (IsDebuggerPresent and hash-based process monitoring for debuggers/VMs/sandboxes) and inhibits recovery by deleting Volume Shadow Copies via vssadmin.exe/wmic.exe. Persistence is established via Startup-folder LNK file creation. Prior to encryption, exfiltration is performed using the legitimate file-sync utility GoodSync (renamed/misrepresented as a standard Windows executable) to move selectively-filtered data to attacker-controlled cloud storage, deliberately avoiding large files or high-value detection triggers.

Ransom notes claim a "security test" was performed, threaten dual extortion (data leak plus DDoS), demand contact via victim-specific onion URLs and/or the email win88@thesecure.biz, and have been observed demanding $300,000, offered alongside a decryption tool and a "penetration test report" as a legitimizing incentive. Victimology skews heavily toward U.S. organizations across varied verticals, with additional incidents in the UK, New Zealand, and India; the group explicitly avoids BRICS/CIS countries, hospitals, and government entities, consistent with typical RaaS affiliate rules-of-engagement.

Cisco Talos published ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0 for the msaRAT loader, Win.Ransomware.Chaos-10045485-0 for the encryptor) and Snort rules (SIDs 66839-66841 / Snort3 301587 for msaRAT network behavior; SIDs 65125-65126 / Snort3 301273 for the broader Chaos campaign), alongside a GitHub IOC repository (github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt).