Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through (TL-2026-1663), also tracked as msaRAT, is a high-severity malware campaign, first published 2026-07-23 and last reviewed 2026-07-25. It is attributed to Chaos with high confidence, affects Google Chrome, maps to 49 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-1663
- Threat ID
- TL-2026-1663
- Also known as
- msaRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-23
- Last reviewed
- 2026-07-25
- Attribution
- Chaos
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, enterprise it, managed service providers
- Target regions
- Unknown / not disclosed
- Detection rules
- 9
- Indicators of compromise
- 29
- Updates
- 2026-07-25 · revalidated 1× · latest source
Malware and tooling in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
Malware and tooling: Chaos ransomware encryptor, msaRAT, AnyDesk, GoodSync, Impacket - S0357, Microsoft Quick Assist, ScreenConnect, Splashtop Streamer, Syncro RMM, Twilio TURN relay
The Chaos ransomware group (assessed with moderate confidence to be a BlackSuit/Royal rebrand or successor) is deploying a Rust/Tokio post-compromise implant called msaRAT that never opens a network connection of its own. Instead it drives a headless Chrome or Edge instance over the Chrome DevTools Protocol and relays all C2 traffic through a WebRTC data channel forced over Twilio's TURN infrastructure, so defenders see nothing but a legitimate-looking HeadlessChrome process calling Cloudflare Workers and Twilio.
How Chaos Ransomware Uses msaRAT to Route C2 Traffic Through works
Cisco Talos documented msaRAT, a previously unreported Rust-based implant written on the Tokio async runtime, discovered on a Windows host during a Chaos ransomware intrusion, deployed after initial access and RMM-based persistence but ahead of the Chaos ransomware encryptor. msaRAT is delivered via an MSI installer (`update_ms.msi`) staged from `https://172.86.126.18:443/update_ms.msi` using `curl.exe` and dropped to `C:\programdata\update_ms.msi`. The MSI impersonates a Windows Update package via forged property metadata and defines a custom action (`CA_Run_EA2AEBC3`) that fires after `InstallFinalize`, loading a DLL (`lib.dll`) embedded in the MSI's Binary table (`Bin_lib_EA2AEBC3`) directly into memory and invoking its exported `RUN` function -- the installer never writes the payload DLL to disk as a standalone file.
Once running, msaRAT enumerates environment variables (`ProgramFiles`, `PROGRAMFILES(X86)`, `LOCALAPPDATA`) and the registry App Paths key (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe`) to locate an installed Chrome or Edge binary, then launches it via `CreateProcessW` with `--headless`, `--disable-gpu`, `--user-data-dir` (a private profile directory, bypassing Chrome 136+ default-profile CDP restrictions announced in March 2025) and `--remote-debugging-port=9222`. msaRAT connects to the browser's local CDP WebSocket endpoint on `localhost:9222` and uses `Runtime.evaluate` to inject JavaScript, and `Runtime.addBinding` to register callback bindings (`msaOpen`, `msaClose`, `msaError`, `msaMessage`) that bridge the injected page context back to the Rust process. All traffic between the RAT process and the browser it controls is confined to loopback (127.0.0.1); the RAT process itself never opens a direct outbound socket.
The injected browser page establishes a WebRTC RTCPeerConnection and creates a DataChannel with a randomly generated 5-20 character alphanumeric label. SDP offer/answer signaling is exchanged out-of-band through a Cloudflare Worker acting as a relay/mailbox (`is-01-ast.ols-img-12.workers.dev`), and STUN discovery uses Google's public server (`stun2.l.google.com`). Critically, the implant deliberately omits host and server-reflexive ICE candidates, preventing any peer-to-peer path from being negotiated, which forces every connection through Twilio's TURN relay service (`global.turn.twilio.com`). The result: outbound network flows from the compromised host are TLS connections from a `HeadlessChrome`-identified process to Cloudflare and Twilio IP space -- infrastructure defenders routinely allowlist. Application-layer messages inside the DataChannel are further encrypted with ChaCha20-Poly1305, keyed via an ECDH handshake (an initial 0xFE-tagged handshake frame) layered underneath the DTLS transport encryption WebRTC already provides, giving double encryption end to end. Outbound HTTP requests forge Origin/Referer headers to impersonate Microsoft's official website.
Chaos itself emerged around February 2025 and is tracked by Talos with moderate confidence as either a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation, based on encryption tooling, ransom-note structure, and TTP overlap; BlackSuit's infrastructure was seized in a DOJ-led international takedown on 2025-07-24. Chaos affiliates gain initial access primarily through email-bombing/vishing campaigns that direct victims to call a fake IT help desk, which then talks the victim into launching Microsoft Quick Assist to grant remote control (T1598.004 combined with abuse of a legitimate remote-assistance utility). Once in, operators install commodity RMM tools (AnyDesk, ScreenConnect, OptiTune, Syncro RMM, Splashtop) for durable access, move laterally via RDP, SMB/admin shares, WMI, and Impacket-based SSH/SMB tooling, and exfiltrate data using GoodSync renamed to masquerade as `wininit.exe`, staged to attacker-controlled cloud storage. The Chaos encryptor supports Windows, ESXi, Linux, and NAS targets, uses Curve25519 ECDH plus AES-256 with per-file keys, and offers a configurable partial/percentage encryption mode (observed default ~30%) for speed, appending the `.chaos` extension. Extortion has escalated from double (encrypt + leak) to triple (add DDoS threats against victim infrastructure) and elements of quadruple extortion (direct outreach to the victim's customers/competitors); one observed ransom demand was $300,000, with payment promising a decryptor, a pen-test report, and an assurance of data deletion.
msaRAT represents a novel, hard-to-detect C2 evasion pattern: it is not a browser exploit, it is abuse of legitimate, fully-patched browser automation (CDP) plus legitimate cloud relay infrastructure (Cloudflare Workers, Twilio TURN) to make ransomware C2 indistinguishable from ordinary browser telemetry. Talos assesses similar TURN-relay C2 concepts were previously demonstrated by Praetorian researchers (August 2025, conferencing-platform TURN infrastructure) and observed in the wild via a WebRTC-based web-skimmer documented by Sansec (March 2026), indicating the technique is proliferating beyond proof-of-concept.
MITRE ATT&CK techniques used in TL-2026-1663
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1219 Remote Access Tools; T1572 Protocol Tunneling
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1012 Query Registry; T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1497 Virtualization/Sandbox Evasion; T1518 Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading; T1684.001 Impersonation
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1204 User Execution
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
T1133 External Remote Services; T1547 Boot or Logon Autostart Execution
stealth
T1218 System Binary Proxy Execution
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Credential Access
T1555 Credentials from Password Stores
command-and-control
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
T1598 Phishing for Information
defense-impairment
Affected products and versions in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Google — Chrome
Vulnerable versions: all versions supporting CDP with attacker-controlled --user-data-dir, incl. 136+ - Microsoft — Edge
Vulnerable versions: all Chromium-based versions supporting CDP with attacker-controlled --user-data-dir - Microsoft — Windows (Chaos ransomware encryptor target)
Vulnerable versions: all supported versions - VMware — ESXi (Chaos ransomware encryptor target)
Vulnerable versions: all supported versions - Linux — Linux distributions (Chaos ransomware encryptor target)
Vulnerable versions: general
Remediation for Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
Immediate actions
- Block/alert on the known msaRAT staging IP 172.86.126.18 and Cloudflare Worker hostname is-01-ast.ols-img-12.workers.dev at perimeter and DNS layers
- Hunt for chrome.exe/msedge.exe child processes launched with --headless (or --headless=new) combined with --remote-debugging-port and a non-default --user-data-dir, spawned by non-interactive/unexpected parent processes
- Hunt for local loopback TCP connections to port 9222 (or other CDP debugging ports) correlated with simultaneous outbound TLS sessions to Cloudflare/Twilio IP ranges from the same host
- Block or restrict outbound access to global.turn.twilio.com and *.workers.dev from endpoints where browser automation is not an expected business function, or alert on it
- Deploy the published ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0, Win.Ransomware.Chaos-10045485-0) and Snort SIDs (66839, 66840, 66841 / 301587 for msaRAT; 65125, 65126 / 301273 for Chaos encryptor)
- Search for the MSI custom-action pattern (CA_* triggered post-InstallFinalize loading an embedded Binary-table DLL via LoadLibrary/GetProcAddress on an export named RUN) in MSI installation telemetry
- Audit and restrict use of Microsoft Quick Assist; require verification before any remote-assistance session is accepted, and train staff on vishing/help-desk-impersonation scripts
Workarounds
- Restrict outbound egress to Chrome-headless-launching hosts to a documented allowlist; deny by default to unfamiliar Cloudflare Workers subdomains and TURN relay endpoints
- Group Policy / AppLocker rule blocking chrome.exe/msedge.exe execution with --remote-debugging-port from non-approved parent processes
Longer-term hardening
- Deploy EDR/XDR with process-ancestry and command-line visibility on browser launches, plus CDP/WebSocket connection monitoring
- Implement application allowlisting to prevent silent MSI custom-action DLL execution outside approved software deployment channels
- Deploy network detection that flags WebRTC/TURN traffic anomalies (e.g., ICE candidate omission forcing TURN-only relay) where feasible via TLS/QUIC fingerprinting or DPI on managed egress
- Restrict and monitor RMM tool installation (AnyDesk, ScreenConnect, Syncro, Splashtop, OptiTune) via allowlist; alert on any RMM binary not centrally deployed
- Enforce MFA and out-of-band verification for helpdesk/IT support requests to blunt vishing-driven initial access
- Maintain offline, immutable backups and test ESXi/Linux/NAS restoration paths given Chaos's cross-platform encryptor
Weaknesses (CWE) in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
CWE-506
Timeline of Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Chaos ransomware group first observed active, assessed with moderate confidence as a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation.
- Chrome 136 ships restrictions preventing CDP debugging against the default browser profile, which msaRAT later bypasses by launching with a dedicated --user-data-dir.
- U.S. Department of Justice seizes BlackSuit ransomware operation infrastructure in an international law-enforcement action, coinciding with Chaos's rise.
- Praetorian researchers publicly demonstrate use of conferencing-platform TURN infrastructure as a C2 relay technique, a precedent for msaRAT's approach.
- Sansec discovers a WebRTC-based web-skimmer using similar data-channel exfiltration techniques in the wild.
- AttackIQ and Security Boulevard publish detection-focused profiles of the Chaos RaaS resurgence, corroborating Talos's Chaos group-profile research.
- Talos researcher Michael Szeliga states host-based detection at browser-launch time is the most reliable detection point and predicts increased future use of browser-mediated C2 techniques, emphasizing behavior-based detection.
- The Hacker News, BleepingComputer, Help Net Security, and GridinSoft publish coverage summarizing the Talos findings.
- Cisco Talos publishes full technical analysis 'Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel' with IOCs, ClamAV, and Snort coverage.
- Cisco Talos discovers msaRAT on a compromised Windows host during a Chaos ransomware intrusion, staged ahead of the ransomware encryptor.
Update history for TL-2026-1663
- 2026-07-25 — msaRAT: Chaos Ransomware's Rust-Based Backdoor Routes C2 Traffic Through Chrome/Edge via CDP and WebRTC: What changed Attribution confidence escalated MEDIUM → HIGH: the newer, more detailed read of the same Talos report attributes msaRAT to the Chaos RaaS operation directly and without hedging, versus the prior entry's more guarded framing. S
Sources cited for Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
- Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
- Unmasking the new Chaos RaaS group attacks
- New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
- Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process
- msaRAT Hides C2 Traffic Inside Chrome and Edge
- Chaos Ransomware: RaaS Resurgence & Detection
- Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities
- Cisco-Talos/IOCs: chaos-msarat.txt
- Chaos ransomware group profile
Threats related to Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel
- Chaos Ransomware Deploys Browser-Based msaRAT to Evade Network Detection
- msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to Chaos Ransomware RaaS
- Chaos Ransomware Group Claims 235GB PHI/Internal Document Leak from Healthcare Highways (Unconfirmed)
- TELESHIM/MIXEDKEY/BINDCLOAK Multi-Stage Malware Chain Abuses Telegram Bot API for C2 Against Middle East Governments
- TONResolver Remote Access Trojan - Active Campaign Targeting Japanese Hospitality Sector
Detection coverage for TL-2026-1663
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1663 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.