# Chaos Ransomware Deploys Browser-Based msaRAT to Evade Network Detection

> Cisco Talos disclosed msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware-as-a-service group that hijacks Chrome/Edge via the Chrome DevTools Protocol and tunnels its command-and-control traffic over WebRTC DataChannels through Twilio TURN relays and Cloudflare Workers signaling infrastructure, so all externally-visible network traffic originates from a legitimate browser process rather than the RAT itself.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1661
- **ID:** TL-2026-1661
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Chaos
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 23, 2026, Cisco Talos published research on msaRAT, a newly identified Rust-based remote access trojan attributed to the Chaos ransomware-as-a-service (RaaS) group, which Talos assesses with moderate confidence is a rebrand or continuation led by former members of the BlackSuit (Royal) ransomware operation. Chaos has been active since at least February 2025, advertising on the Russian-language forum RAMP (Ransom Anon Market Place), and was separately linked in mid-2025 to the Iranian state-sponsored MuddyWater (Seedworm) APT, which Talos assesses used the Chaos brand as cover for espionage operations tied to a specific code-signing certificate and shared C2 infrastructure.

In the campaign documented here, initial access follows Chaos's established pattern: spam email flooding followed by voice-based social engineering (vishing) in which operators impersonate IT/security staff and coax victims into activating Microsoft Quick Assist for remote-control access. Once a foothold is established, operators deploy commercial remote monitoring and management (RMM) tools -- AnyDesk, ScreenConnect, OptiTune, Syncro RMM, and Splashtop -- for durable remote access, and pivot into the environment via RDP, SMB/Windows Admin Shares, and SSH, using the Impacket toolkit for remote command execution and reverse SSH tunnels to command infrastructure (observed example: 45.61.134.36:443).

The distinguishing element of this campaign is msaRAT, delivered via a curl download of an MSI installer (update_ms.msi, staged from 172.86.126.18 over port 443) disguised as a Windows update. The MSI's custom action (CA_Run_EA2AEBC3) loads the RAT payload (lib.dll) directly into memory from the MSI's embedded Binary table, avoiding a dropped executable. msaRAT is built on the Rust Tokio async runtime and is architected around a hard design constraint: the RAT process itself never touches the network -- all outbound traffic (127.0.0.1 loopback only from the RAT process) is instead relayed through a headless instance of the victim's own Chrome or Edge browser, located via environment-variable probing and registry fallback, and launched with remote debugging enabled on port 9222.

msaRAT drives the browser purely through Chrome DevTools Protocol (CDP) calls: Target.createTarget to spin up a hidden tab, Page.enable/Runtime.enable to activate a JS execution context, Page.setBypassCSP to disable Content-Security-Policy restrictions that would otherwise block the injected logic, Runtime.addBinding to register five JS-to-native callback bindings (msaOpen, msaClose, msaError, msaMessage, dataAck -- the source of the RAT's name), and Runtime.evaluate to inject the JavaScript that performs the actual WebRTC signaling and data-channel handling inside the browser's own JS engine. Because the browser, not the RAT, originates every packet, the campaign evades network monitoring built around process-to-network attribution.

Signaling is handled by a Cloudflare Workers endpoint (is-01-ast.ols-img-12.workers.dev) which the injected browser JS queries via HTTPS GET (with Origin/Referer headers spoofed to resemble Microsoft traffic) to retrieve STUN/TURN configuration. The browser then performs a STUN request to a legitimate Google STUN server (stun2.l.google.com) and establishes a WebRTC RTCPeerConnection whose actual media path is forced through Twilio's TURN relay infrastructure (global.turn.twilio.com): the Cloudflare Workers signaling response intentionally omits ICE candidates and sets the connection address to 0.0.0.0, which prevents any direct peer-to-peer path and guarantees all C2 traffic is relayed via Twilio, hiding the true C2 server IP entirely from the victim's network telemetry. A DataChannel with a randomized 5-20 character alphanumeric label is then negotiated via SDP Offer/Answer exchange (POST to the Workers signaling endpoint).

On top of the browser-native DTLS transport encryption, msaRAT layers application-level encryption: the C2 sends a Handshake frame (opcode 0xFE) containing an ECDH public key, the RAT generates its own ephemeral key pair, derives a shared secret, and encrypts/decrypts all subsequent frames with ChaCha20-Poly1305 using that derived key -- defeating passive and even active (TLS-terminating) network inspection since the payload is encrypted a second time before ever reaching the browser's transport layer. Commands are processed through a two-layer state machine: an outer layer tracking connection state (Handshake, Ready, etc.) and an inner layer dispatching individual command frames, consistent with a full interactive remote-access capability set typical of Rust-based RATs (shell execution, file transfer, and system reconnaissance), though Talos's public writeup did not enumerate every inner-frame opcode.

Once ransomware deployment is triggered, Chaos's encryptor uses hybrid cryptography: ECDH (Curve25519) to negotiate per-file/session keys and AES-256 (CFB mode observed, with RSA-1024 key wrapping per detection-engineering writeups) to encrypt file contents, appending a .chaos extension with a 60-byte metadata header. The encryptor supports a configurable encrypt_step parameter (default 30%, partial/selective encryption to speed up large-scale runs), and local/network/combined work modes (invoked e.g. Encryptor.exe /lkey:"<32-byte key>" /encrypt_step:40 /work_mode:local_network). Before encryption, the malware performs anti-analysis checks (IsDebuggerPresent and hash-based process monitoring for debuggers/VMs/sandboxes) and inhibits recovery by deleting Volume Shadow Copies via vssadmin.exe/wmic.exe. Persistence is established via Startup-folder LNK file creation. Prior to encryption, exfiltration is performed using the legitimate file-sync utility GoodSync (renamed/misrepresented as a standard Windows executable) to move selectively-filtered data to attacker-controlled cloud storage, deliberately avoiding large files or high-value detection triggers.

Ransom notes claim a "security test" was performed, threaten dual extortion (data leak plus DDoS), demand contact via victim-specific onion URLs and/or the email win88@thesecure.biz, and have been observed demanding $300,000, offered alongside a decryption tool and a "penetration test report" as a legitimizing incentive. Victimology skews heavily toward U.S. organizations across varied verticals, with additional incidents in the UK, New Zealand, and India; the group explicitly avoids BRICS/CIS countries, hospitals, and government entities, consistent with typical RaaS affiliate rules-of-engagement.

Cisco Talos published ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0 for the msaRAT loader, Win.Ransomware.Chaos-10045485-0 for the encryptor) and Snort rules (SIDs 66839-66841 / Snort3 301587 for msaRAT network behavior; SIDs 65125-65126 / Snort3 301273 for the broader Chaos campaign), alongside a GitHub IOC repository (github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt).

## MITRE ATT&CK

- T1566 Phishing
- T1133 External Remote Services
- T1078 Valid Accounts
- T1106 Native API
- T1047 Windows Management Instrumentation
- T1547 Boot or Logon Autostart Execution
- T1219 Remote Access Tools
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1012 Query Registry
- T1614 System Location Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1482 Domain Trust Discovery
- T1680 Local Storage Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1572 Protocol Tunneling
- T1090 Proxy
- T1095 Non-Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Chaos ransomware deploys browser-based msaRAT to evade network detection](https://securityaffairs.com/195876/malware/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection.html)
- [Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel](https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/)
- [Unmasking the new Chaos RaaS group attacks](https://blog.talosintelligence.com/new-chaos-ransomware/)
- [Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process](https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/)
- [New msaRAT malware uses Chrome, Edge browsers to route C2 traffic](https://www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/)
- [Chaos Ransomware: RaaS Resurgence & Detection](https://www.attackiq.com/2026/07/16/chaos-ransomware/)
- [Chaos Ransomware Msarat Uses Browsers For Covert C2](https://cypro.co.uk/insights/cyber-bulletins/chaos-ransomwares-msarat-rust-rat-exploits-browsers-for-c2/)
- [msaRAT Hides C2 Traffic Inside Chrome and Edge](https://blog.gridinsoft.com/msarat-chrome-edge-browser-c2/)
- [Chaos Ransomware: New RaaS Group (Likely Former BlackSuit) Unleashes Vishing & Double Extortion](https://securityonline.info/chaos-ransomware-new-raas-group-likely-former-blacksuit-unleashes-vishing-double-extortion/)
- [Cisco Talos IOCs Repository](https://github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1661