Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge — Threadlinqs Intelligence
As of 2026-07-23, Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge is a high-severity malware threat attributed to Chaos, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1663 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Chaos · FINANCIAL
The Chaos ransomware group (assessed with moderate confidence to be a BlackSuit/Royal rebrand or successor) is deploying a Rust/Tokio post-compromise implant called msaRAT that never opens a network
Cisco Talos documented msaRAT, a previously unreported Rust-based implant written on the Tokio async runtime, discovered on a Windows host during a Chaos ransomware intrusion, deployed after initial access and RMM-based persistence but ahead of the Chaos ransomware encryptor. msaRAT is delivered via an MSI installer (`update_ms.msi`) staged from `https://172.86.126.18:443/update_ms.msi` using `curl.exe` and dropped to `C:\programdata\update_ms.msi`. The MSI impersonates a Windows Update package via forged property metadata and defines a custom action (`CA_Run_EA2AEBC3`) that fires after `InstallFinalize`, loading a DLL (`lib.dll`) embedded in the MSI's Binary table (`Bin_lib_EA2AEBC3`) directly into memory and invoking its exported `RUN` function -- the installer never writes the payload DLL to disk as a standalone file.
Once running, msaRAT enumerates environment variables (`ProgramFiles`, `PROGRAMFILES(X86)`, `LOCALAPPDATA`) and the registry App Paths key (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe`) to locate an installed Chrome or Edge binary, then launches it via `CreateProcessW` with `--headless`, `--disable-gpu`, `--user-data-dir` (a private profile directory, bypassing Chrome 136+ default-profile CDP restrictions announced in March 2025) and `--remote-debugging-port=9222`. msaRAT connects to the browser's local CDP WebSocket endpoint on `localhost:9222` and uses `Runtime.evaluate` to inject JavaScript, and `Runtime.addBinding` to register callback bindings (`msaOpen`, `msaClose`, `msaError`, `msaMessage`) that bridge the injected page context back to the Rust process. All traffic between the RAT process and the browser it controls is confined to loopback (127.0.0.1); the RAT process itself never opens a direct outbound socket.
The injected browser page establishes a WebRTC RTCPeerConnection and creates a DataChannel with a randomly generated 5-20 character alphanumeric label. SDP offer/answer signaling is exchanged out-of-band through a Cloudflare Worker acting as a relay/mailbox (`is-01-ast.ols-img-12.workers.dev`), and STUN discovery uses Google's public server (`stun2.l.google.com`). Critically, the implant deliberately omits host and server-reflexive ICE candidates, preventing any peer-to-peer path from being negotiated, which forces every connection through Twilio's TURN relay service (`global.turn.twilio.com`). The result: outbound network flows from the compromised host are TLS connections from a `HeadlessChrome`-identified process to Cloudflare and Twilio IP space -- infrastructure defenders routinely allowlist. Application-layer messages inside the DataChannel are further encrypted with ChaCha20-Poly1305, keyed via an ECDH handshake (an initial 0xFE-tagged handshake frame) layered underneath the DTLS transport encryption WebRTC already provides, giving double encryption end to end. Outbound HTTP requests forge Origin/Referer headers to impersonate Microsoft's official website.
Chaos itself emerged around February 2025 and is tracked by Talos with moderate confidence as either a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation, based on encryption tooling, ransom-note structure, and TTP overlap; BlackSuit's infrastructure was seized in a DOJ-led international takedown on 2025-07-24. Chaos affiliates gain initial access primarily through email-bombing/vishing campaigns that direct victims to call a fake IT help desk, which then talks the victim into launching Microsoft Quick Assist to grant remote control (T1598.004 combined with abuse of a legitimate remote-assistance utility). Once in, operators install commodity RMM tools (AnyDesk, ScreenConnect, OptiTune, Syncro RMM, Splashtop) for durable access, move laterally via RDP, SMB/admin shares, WMI, and Impacket-based SSH/SMB tooling, and exfiltrate data using GoodSync renamed to masquerade as `wininit.exe`, staged to attacker-controlled cloud storage. The Chaos encryptor supports Window
Target sectors: cross-sector, enterprise it, managed service providers
Target regions: Unknown / not disclosed
Detections & IOCs
As of 2026-07-24, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1598, T1078, T1059, T1059, T1047, T1106, T1547, T1133, T1036, T1036