Threat reportMalwareTL-2026-1663
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through (TL-2026-1663), also tracked as msaRAT, is a high-severity malware campaign, first published 2026-07-23 and last reviewed 2026-07-25. It is attributed to Chaos with high confidence, affects Google Chrome, maps to 49 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 49MITRE ATT&CK
- Actors
- 1Chaos
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-1663
- Threat ID
- TL-2026-1663
- Also known as
- msaRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Chaos
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- cross-sector, enterprise it, managed service providers
- Target regions
- Unknown / not disclosed
- Detection rules
- 9
- Indicators of compromise
- 29
- Updates
- 2026-07-25 · revalidated 1× · latest source
Malware and tooling in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
Malware and tooling: Chaos ransomware encryptor, msaRAT, AnyDesk, GoodSync, Impacket - S0357, Microsoft Quick Assist, ScreenConnect, Splashtop Streamer, Syncro RMM, Twilio TURN relay
How Chaos Ransomware Uses msaRAT to Route C2 Traffic Through works
The Chaos ransomware group (assessed with moderate confidence to be a BlackSuit/Royal rebrand or successor) is deploying a Rust/Tokio post-compromise implant called msaRAT that never opens a network connection of its own. Instead it drives a headless Chrome or Edge instance over the Chrome DevTools Protocol and relays all C2 traffic through a WebRTC data channel forced over Twilio's TURN infrastructure, so defenders see nothing but a legitimate-looking HeadlessChrome process calling Cloudflare Workers and Twilio.
Cisco Talos documented msaRAT, a previously unreported Rust-based implant written on the Tokio async runtime, discovered on a Windows host during a Chaos ransomware intrusion, deployed after initial access and RMM-based persistence but ahead of the Chaos ransomware encryptor. msaRAT is delivered via an MSI installer (`update_ms.msi`) staged from `https://172.86.126.18:443/update_ms.msi` using `curl.exe` and dropped to `C:\programdata\update_ms.msi`. The MSI impersonates a Windows Update package via forged property metadata and defines a custom action (`CA_Run_EA2AEBC3`) that fires after `InstallFinalize`, loading a DLL (`lib.dll`) embedded in the MSI's Binary table (`Bin_lib_EA2AEBC3`) directly into memory and invoking its exported `RUN` function -- the installer never writes the payload DLL to disk as a standalone file.
Once running, msaRAT enumerates environment variables (`ProgramFiles`, `PROGRAMFILES(X86)`, `LOCALAPPDATA`) and the registry App Paths key (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe`) to locate an installed Chrome or Edge binary, then launches it via `CreateProcessW` with `--headless`, `--disable-gpu`, `--user-data-dir` (a private profile directory, bypassing Chrome 136+ default-profile CDP restrictions announced in March 2025) and `--remote-debugging-port=9222`. msaRAT connects to the browser's local CDP WebSocket endpoint on `localhost:9222` and uses `Runtime.evaluate` to inject JavaScript, and `Runtime.addBinding` to register callback bindings (`msaOpen`, `msaClose`, `msaError`, `msaMessage`) that bridge the injected page context back to the Rust process. All traffic between the RAT process and the browser it controls is confined to loopback (127.0.0.1); the RAT process itself never opens a direct outbound socket.
The injected browser page establishes a WebRTC RTCPeerConnection and creates a DataChannel with a randomly generated 5-20 character alphanumeric label. SDP offer/answer signaling is exchanged out-of-band through a Cloudflare Worker acting as a relay/mailbox (`is-01-ast.ols-img-12.workers.dev`), and STUN discovery uses Google's public server (`stun2.l.google.com`). Critically, the implant deliberately omits host and server-reflexive ICE candidates, preventing any peer-to-peer path from being negotiated, which forces every connection through Twilio's TURN relay service (`global.turn.twilio.com`). The result: outbound network flows from the compromised host are TLS connections from a `HeadlessChrome`-identified process to Cloudflare and Twilio IP space -- infrastructure defenders routinely allowlist. Application-layer messages inside the DataChannel are further encrypted with ChaCha20-Poly1305, keyed via an ECDH handshake (an initial 0xFE-tagged handshake frame) layered underneath the DTLS transport encryption WebRTC already provides, giving double encryption end to end. Outbound HTTP requests forge Origin/Referer headers to impersonate Microsoft's official website.
Chaos itself emerged around February 2025 and is tracked by Talos with moderate confidence as either a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation, based on encryption tooling, ransom-note structure, and TTP overlap; BlackSuit's infrastructure was seized in a DOJ-led international takedown on 2025-07-24. Chaos affiliates gain initial access primarily through email-bombing/vishing campaigns that direct victims to call a fake IT help desk, which then talks the victim into launching Microsoft Quick Assist to grant remote control (T1598.004 combined with abuse of a legitimate remote-assistance utility). Once in, operators install commodity RMM tools (AnyDesk, ScreenConnect, OptiTune, Syncro RMM, Splashtop) for durable access, move laterally via RDP, SMB/admin shares, WMI, and Impacket-based SSH/SMB tooling, and exfiltrate data using GoodSync renamed to masquerade as `wininit.exe`, staged to attacker-controlled cloud storage. The Chaos encryptor supports Windows, ESXi, Linux, and NAS targets, uses Curve25519 ECDH plus AES-256 with per-file keys, and offers a configurable partial/percentage encryption mode (observed default ~30%) for speed, appending the `.chaos` extension. Extortion has escalated from double (encrypt + leak) to triple (add DDoS threats against victim infrastructure) and elements of quadruple extortion (direct outreach to the victim's customers/competitors); one observed ransom demand was $300,000, with payment promising a decryptor, a pen-test report, and an assurance of data deletion.
msaRAT represents a novel, hard-to-detect C2 evasion pattern: it is not a browser exploit, it is abuse of legitimate, fully-patched browser automation (CDP) plus legitimate cloud relay infrastructure (Cloudflare Workers, Twilio TURN) to make ransomware C2 indistinguishable from ordinary browser telemetry. Talos assesses similar TURN-relay C2 concepts were previously demonstrated by Praetorian researchers (August 2025, conferencing-platform TURN infrastructure) and observed in the wild via a WebRTC-based web-skimmer documented by Sansec (March 2026), indicating the technique is proliferating beyond proof-of-concept.
MITRE ATT&CK techniques used in TL-2026-1663
Command and Control
T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1219 Remote Access Tools; T1572 Protocol Tunneling
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1012 Query Registry; T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1497 Virtualization/Sandbox Evasion; T1518 Software Discovery
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading; T1684.001 Impersonation
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1204 User Execution
Initial Access
T1078 Valid Accounts; T1566 Phishing
Persistence
T1133 External Remote Services; T1547 Boot or Logon Autostart Execution
stealth
T1218 System Binary Proxy Execution
Impact
T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery
Credential Access
T1555 Credentials from Password Stores
command-and-control
Resource Development
T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities
reconnaissance
T1598 Phishing for Information
defense-impairment
Affected products and versions in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Google — Chrome
Vulnerable versions: all versions supporting CDP with attacker-controlled --user-data-dir, incl. 136+ - Microsoft — Edge
Vulnerable versions: all Chromium-based versions supporting CDP with attacker-controlled --user-data-dir - Microsoft — Windows (Chaos ransomware encryptor target)
Vulnerable versions: all supported versions - VMware — ESXi (Chaos ransomware encryptor target)
Vulnerable versions: all supported versions - Linux — Linux distributions (Chaos ransomware encryptor target)
Vulnerable versions: general
Remediation for Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
Immediate actions
- Block/alert on the known msaRAT staging IP 172.86.126.18 and Cloudflare Worker hostname is-01-ast.ols-img-12.workers.dev at perimeter and DNS layers
- Hunt for chrome.exe/msedge.exe child processes launched with --headless (or --headless=new) combined with --remote-debugging-port and a non-default --user-data-dir, spawned by non-interactive/unexpected parent processes
- Hunt for local loopback TCP connections to port 9222 (or other CDP debugging ports) correlated with simultaneous outbound TLS sessions to Cloudflare/Twilio IP ranges from the same host
- Block or restrict outbound access to global.turn.twilio.com and *.workers.dev from endpoints where browser automation is not an expected business function, or alert on it
- Deploy the published ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0, Win.Ransomware.Chaos-10045485-0) and Snort SIDs (66839, 66840, 66841 / 301587 for msaRAT; 65125, 65126 / 301273 for Chaos encryptor)
- Search for the MSI custom-action pattern (CA_* triggered post-InstallFinalize loading an embedded Binary-table DLL via LoadLibrary/GetProcAddress on an export named RUN) in MSI installation telemetry
- Audit and restrict use of Microsoft Quick Assist; require verification before any remote-assistance session is accepted, and train staff on vishing/help-desk-impersonation scripts
Workarounds
- Restrict outbound egress to Chrome-headless-launching hosts to a documented allowlist; deny by default to unfamiliar Cloudflare Workers subdomains and TURN relay endpoints
- Group Policy / AppLocker rule blocking chrome.exe/msedge.exe execution with --remote-debugging-port from non-approved parent processes
Longer-term hardening
- Deploy EDR/XDR with process-ancestry and command-line visibility on browser launches, plus CDP/WebSocket connection monitoring
- Implement application allowlisting to prevent silent MSI custom-action DLL execution outside approved software deployment channels
- Deploy network detection that flags WebRTC/TURN traffic anomalies (e.g., ICE candidate omission forcing TURN-only relay) where feasible via TLS/QUIC fingerprinting or DPI on managed egress
- Restrict and monitor RMM tool installation (AnyDesk, ScreenConnect, Syncro, Splashtop, OptiTune) via allowlist; alert on any RMM binary not centrally deployed
- Enforce MFA and out-of-band verification for helpdesk/IT support requests to blunt vishing-driven initial access
- Maintain offline, immutable backups and test ESXi/Linux/NAS restoration paths given Chaos's cross-platform encryptor
Weaknesses (CWE) in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
Timeline of Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Chaos ransomware group first observed active, assessed with moderate confidence as a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation.
- Chrome 136 ships restrictions preventing CDP debugging against the default browser profile, which msaRAT later bypasses by launching with a dedicated --user-data-dir.
- U.S. Department of Justice seizes BlackSuit ransomware operation infrastructure in an international law-enforcement action, coinciding with Chaos's rise.
- Praetorian researchers publicly demonstrate use of conferencing-platform TURN infrastructure as a C2 relay technique, a precedent for msaRAT's approach.
- Sansec discovers a WebRTC-based web-skimmer using similar data-channel exfiltration techniques in the wild.
- AttackIQ and Security Boulevard publish detection-focused profiles of the Chaos RaaS resurgence, corroborating Talos's Chaos group-profile research.
- Talos researcher Michael Szeliga states host-based detection at browser-launch time is the most reliable detection point and predicts increased future use of browser-mediated C2 techniques, emphasizing behavior-based detection.
- The Hacker News, BleepingComputer, Help Net Security, and GridinSoft publish coverage summarizing the Talos findings.
- Cisco Talos publishes full technical analysis 'Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel' with IOCs, ClamAV, and Snort coverage.
- Cisco Talos discovers msaRAT on a compromised Windows host during a Chaos ransomware intrusion, staged ahead of the ransomware encryptor.
Update history for TL-2026-1663
- 2026-07-25 — msaRAT: Chaos Ransomware's Rust-Based Backdoor Routes C2 Traffic Through Chrome/Edge via CDP and WebRTC: What changed Attribution confidence escalated MEDIUM → HIGH: the newer, more detailed read of the same Talos report attributes msaRAT to the Chaos RaaS operation directly and without hedging, versus the prior entry's more guarded framing. S
Sources cited for Chaos Ransomware Uses msaRAT to Route C2 Traffic Through
- Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
- Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
- Unmasking the new Chaos RaaS group attacks
- New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
- Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process
- msaRAT Hides C2 Traffic Inside Chrome and Edge
- Chaos Ransomware: RaaS Resurgence & Detection
- Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities
- Cisco-Talos/IOCs: chaos-msarat.txt
- Chaos ransomware group profile
Detection coverage for TL-2026-1663
As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1663 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.