Chaos Ransomware Deploys Browser-Based msaRAT to Evade Network Detection — Threadlinqs Intelligence
As of 2026-07-23, Chaos Ransomware Deploys Browser-Based msaRAT to Evade Network Detection is a high-severity ransomware threat attributed to Chaos, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1661 · Severity: HIGH · Status: ACTIVE · Category: RANSOMWARE
Attribution: Chaos · FINANCIAL
Cisco Talos disclosed msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware-as-a-service group that hijacks Chrome/Edge via the Chrome DevTools Protocol and tunnels its
On July 23, 2026, Cisco Talos published research on msaRAT, a newly identified Rust-based remote access trojan attributed to the Chaos ransomware-as-a-service (RaaS) group, which Talos assesses with moderate confidence is a rebrand or continuation led by former members of the BlackSuit (Royal) ransomware operation. Chaos has been active since at least February 2025, advertising on the Russian-language forum RAMP (Ransom Anon Market Place), and was separately linked in mid-2025 to the Iranian state-sponsored MuddyWater (Seedworm) APT, which Talos assesses used the Chaos brand as cover for espionage operations tied to a specific code-signing certificate and shared C2 infrastructure.
In the campaign documented here, initial access follows Chaos's established pattern: spam email flooding followed by voice-based social engineering (vishing) in which operators impersonate IT/security staff and coax victims into activating Microsoft Quick Assist for remote-control access. Once a foothold is established, operators deploy commercial remote monitoring and management (RMM) tools -- AnyDesk, ScreenConnect, OptiTune, Syncro RMM, and Splashtop -- for durable remote access, and pivot into the environment via RDP, SMB/Windows Admin Shares, and SSH, using the Impacket toolkit for remote command execution and reverse SSH tunnels to command infrastructure (observed example: 45.61.134.36:443).
The distinguishing element of this campaign is msaRAT, delivered via a curl download of an MSI installer (update_ms.msi, staged from 172.86.126.18 over port 443) disguised as a Windows update. The MSI's custom action (CA_Run_EA2AEBC3) loads the RAT payload (lib.dll) directly into memory from the MSI's embedded Binary table, avoiding a dropped executable. msaRAT is built on the Rust Tokio async runtime and is architected around a hard design constraint: the RAT process itself never touches the network -- all outbound traffic (127.0.0.1 loopback only from the RAT process) is instead relayed through a headless instance of the victim's own Chrome or Edge browser, located via environment-variable probing and registry fallback, and launched with remote debugging enabled on port 9222.
msaRAT drives the browser purely through Chrome DevTools Protocol (CDP) calls: Target.createTarget to spin up a hidden tab, Page.enable/Runtime.enable to activate a JS execution context, Page.setBypassCSP to disable Content-Security-Policy restrictions that would otherwise block the injected logic, Runtime.addBinding to register five JS-to-native callback bindings (msaOpen, msaClose, msaError, msaMessage, dataAck -- the source of the RAT's name), and Runtime.evaluate to inject the JavaScript that performs the actual WebRTC signaling and data-channel handling inside the browser's own JS engine. Because the browser, not the RAT, originates every packet, the campaign evades network monitoring built around process-to-network attribution.
Signaling is handled by a Cloudflare Workers endpoint (is-01-ast.ols-img-12.workers.dev) which the injected browser JS queries via HTTPS GET (with Origin/Referer headers spoofed to resemble Microsoft traffic) to retrieve STUN/TURN configuration. The browser then performs a STUN request to a legitimate Google STUN server (stun2.l.google.com) and establishes a WebRTC RTCPeerConnection whose actual media path is forced through Twilio's TURN relay infrastructure (global.turn.twilio.com): the Cloudflare Workers signaling response intentionally omits ICE candidates and sets the connection address to 0.0.0.0, which prevents any direct peer-to-peer path and guarantees all C2 traffic is relayed via Twilio, hiding the true C2 server IP entirely from the victim's network telemetry. A DataChannel with a randomized 5-20 character alphanumeric label is then negotiated via SDP Offer/Answer exchange (POST to the Workers signaling endpoint).
On top of the browser-native DTLS transport encryption, msaRAT layers application-level encryption: the C2 sends a Handshake f
Target sectors: various commercial verticals, excludes hospitals, excludes government
Target regions: united states of america, united kingdom, new zealand, india
Detections & IOCs
As of 2026-07-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566, T1133, T1078, T1106, T1047, T1547, T1219, T1497, T1036