Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through (TL-2026-1663), also tracked as msaRAT, is a high-severity malware campaign, first published 2026-07-23 and last reviewed 2026-07-25. It is attributed to Chaos with high confidence, affects Google Chrome, maps to 49 MITRE ATT&CK techniques (T1001, T1005, T1008), and is covered by 9 detection rules and 29 indicators of compromise.

Key facts for TL-2026-1663

Threat ID
TL-2026-1663
Also known as
msaRAT
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-23
Last reviewed
2026-07-25
Attribution
Chaos
Attribution confidence
HIGH
Motivation
FINANCIAL
Target sectors
cross-sector, enterprise it, managed service providers
Target regions
Unknown / not disclosed
Detection rules
9
Indicators of compromise
29
Updates
2026-07-25 · revalidated 1× · latest source

Malware and tooling in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

Malware and tooling: Chaos ransomware encryptor, msaRAT, AnyDesk, GoodSync, Impacket - S0357, Microsoft Quick Assist, ScreenConnect, Splashtop Streamer, Syncro RMM, Twilio TURN relay

The Chaos ransomware group (assessed with moderate confidence to be a BlackSuit/Royal rebrand or successor) is deploying a Rust/Tokio post-compromise implant called msaRAT that never opens a network connection of its own. Instead it drives a headless Chrome or Edge instance over the Chrome DevTools Protocol and relays all C2 traffic through a WebRTC data channel forced over Twilio's TURN infrastructure, so defenders see nothing but a legitimate-looking HeadlessChrome process calling Cloudflare Workers and Twilio.

How Chaos Ransomware Uses msaRAT to Route C2 Traffic Through works

Cisco Talos documented msaRAT, a previously unreported Rust-based implant written on the Tokio async runtime, discovered on a Windows host during a Chaos ransomware intrusion, deployed after initial access and RMM-based persistence but ahead of the Chaos ransomware encryptor. msaRAT is delivered via an MSI installer (`update_ms.msi`) staged from `https://172.86.126.18:443/update_ms.msi` using `curl.exe` and dropped to `C:\programdata\update_ms.msi`. The MSI impersonates a Windows Update package via forged property metadata and defines a custom action (`CA_Run_EA2AEBC3`) that fires after `InstallFinalize`, loading a DLL (`lib.dll`) embedded in the MSI's Binary table (`Bin_lib_EA2AEBC3`) directly into memory and invoking its exported `RUN` function -- the installer never writes the payload DLL to disk as a standalone file.

Once running, msaRAT enumerates environment variables (`ProgramFiles`, `PROGRAMFILES(X86)`, `LOCALAPPDATA`) and the registry App Paths key (`HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe`) to locate an installed Chrome or Edge binary, then launches it via `CreateProcessW` with `--headless`, `--disable-gpu`, `--user-data-dir` (a private profile directory, bypassing Chrome 136+ default-profile CDP restrictions announced in March 2025) and `--remote-debugging-port=9222`. msaRAT connects to the browser's local CDP WebSocket endpoint on `localhost:9222` and uses `Runtime.evaluate` to inject JavaScript, and `Runtime.addBinding` to register callback bindings (`msaOpen`, `msaClose`, `msaError`, `msaMessage`) that bridge the injected page context back to the Rust process. All traffic between the RAT process and the browser it controls is confined to loopback (127.0.0.1); the RAT process itself never opens a direct outbound socket.

The injected browser page establishes a WebRTC RTCPeerConnection and creates a DataChannel with a randomly generated 5-20 character alphanumeric label. SDP offer/answer signaling is exchanged out-of-band through a Cloudflare Worker acting as a relay/mailbox (`is-01-ast.ols-img-12.workers.dev`), and STUN discovery uses Google's public server (`stun2.l.google.com`). Critically, the implant deliberately omits host and server-reflexive ICE candidates, preventing any peer-to-peer path from being negotiated, which forces every connection through Twilio's TURN relay service (`global.turn.twilio.com`). The result: outbound network flows from the compromised host are TLS connections from a `HeadlessChrome`-identified process to Cloudflare and Twilio IP space -- infrastructure defenders routinely allowlist. Application-layer messages inside the DataChannel are further encrypted with ChaCha20-Poly1305, keyed via an ECDH handshake (an initial 0xFE-tagged handshake frame) layered underneath the DTLS transport encryption WebRTC already provides, giving double encryption end to end. Outbound HTTP requests forge Origin/Referer headers to impersonate Microsoft's official website.

Chaos itself emerged around February 2025 and is tracked by Talos with moderate confidence as either a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation, based on encryption tooling, ransom-note structure, and TTP overlap; BlackSuit's infrastructure was seized in a DOJ-led international takedown on 2025-07-24. Chaos affiliates gain initial access primarily through email-bombing/vishing campaigns that direct victims to call a fake IT help desk, which then talks the victim into launching Microsoft Quick Assist to grant remote control (T1598.004 combined with abuse of a legitimate remote-assistance utility). Once in, operators install commodity RMM tools (AnyDesk, ScreenConnect, OptiTune, Syncro RMM, Splashtop) for durable access, move laterally via RDP, SMB/admin shares, WMI, and Impacket-based SSH/SMB tooling, and exfiltrate data using GoodSync renamed to masquerade as `wininit.exe`, staged to attacker-controlled cloud storage. The Chaos encryptor supports Windows, ESXi, Linux, and NAS targets, uses Curve25519 ECDH plus AES-256 with per-file keys, and offers a configurable partial/percentage encryption mode (observed default ~30%) for speed, appending the `.chaos` extension. Extortion has escalated from double (encrypt + leak) to triple (add DDoS threats against victim infrastructure) and elements of quadruple extortion (direct outreach to the victim's customers/competitors); one observed ransom demand was $300,000, with payment promising a decryptor, a pen-test report, and an assurance of data deletion.

msaRAT represents a novel, hard-to-detect C2 evasion pattern: it is not a browser exploit, it is abuse of legitimate, fully-patched browser automation (CDP) plus legitimate cloud relay infrastructure (Cloudflare Workers, Twilio TURN) to make ransomware C2 indistinguishable from ordinary browser telemetry. Talos assesses similar TURN-relay C2 concepts were previously demonstrated by Praetorian researchers (August 2025, conferencing-platform TURN infrastructure) and observed in the wild via a WebRTC-based web-skimmer documented by Sansec (March 2026), indicating the technique is proliferating beyond proof-of-concept.

MITRE ATT&CK techniques used in TL-2026-1663

Command and Control

T1001 Data Obfuscation; T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1105 Ingress Tool Transfer; T1132 Data Encoding; T1219 Remote Access Tools; T1572 Protocol Tunneling

Collection

T1005 Data from Local System; T1113 Screen Capture

Discovery

T1012 Query Registry; T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1497 Virtualization/Sandbox Evasion; T1518 Software Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading; T1684.001 Impersonation

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API; T1129 Shared Modules; T1204 User Execution

Initial Access

T1078 Valid Accounts; T1566 Phishing

Persistence

T1133 External Remote Services; T1547 Boot or Logon Autostart Execution

stealth

T1218 System Binary Proxy Execution

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

Credential Access

T1555 Credentials from Password Stores

command-and-control

T1573 Encrypted Channel

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1608 Stage Capabilities

reconnaissance

T1598 Phishing for Information

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

  • Google — Chrome
    Vulnerable versions: all versions supporting CDP with attacker-controlled --user-data-dir, incl. 136+
  • Microsoft — Edge
    Vulnerable versions: all Chromium-based versions supporting CDP with attacker-controlled --user-data-dir
  • Microsoft — Windows (Chaos ransomware encryptor target)
    Vulnerable versions: all supported versions
  • VMware — ESXi (Chaos ransomware encryptor target)
    Vulnerable versions: all supported versions
  • Linux — Linux distributions (Chaos ransomware encryptor target)
    Vulnerable versions: general

Remediation for Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

Immediate actions

  • Block/alert on the known msaRAT staging IP 172.86.126.18 and Cloudflare Worker hostname is-01-ast.ols-img-12.workers.dev at perimeter and DNS layers
  • Hunt for chrome.exe/msedge.exe child processes launched with --headless (or --headless=new) combined with --remote-debugging-port and a non-default --user-data-dir, spawned by non-interactive/unexpected parent processes
  • Hunt for local loopback TCP connections to port 9222 (or other CDP debugging ports) correlated with simultaneous outbound TLS sessions to Cloudflare/Twilio IP ranges from the same host
  • Block or restrict outbound access to global.turn.twilio.com and *.workers.dev from endpoints where browser automation is not an expected business function, or alert on it
  • Deploy the published ClamAV signatures (Win.Downloader.ChaosRaas-10060321-0, Win.Ransomware.Chaos-10045485-0) and Snort SIDs (66839, 66840, 66841 / 301587 for msaRAT; 65125, 65126 / 301273 for Chaos encryptor)
  • Search for the MSI custom-action pattern (CA_* triggered post-InstallFinalize loading an embedded Binary-table DLL via LoadLibrary/GetProcAddress on an export named RUN) in MSI installation telemetry
  • Audit and restrict use of Microsoft Quick Assist; require verification before any remote-assistance session is accepted, and train staff on vishing/help-desk-impersonation scripts

Workarounds

  • Restrict outbound egress to Chrome-headless-launching hosts to a documented allowlist; deny by default to unfamiliar Cloudflare Workers subdomains and TURN relay endpoints
  • Group Policy / AppLocker rule blocking chrome.exe/msedge.exe execution with --remote-debugging-port from non-approved parent processes

Longer-term hardening

  • Deploy EDR/XDR with process-ancestry and command-line visibility on browser launches, plus CDP/WebSocket connection monitoring
  • Implement application allowlisting to prevent silent MSI custom-action DLL execution outside approved software deployment channels
  • Deploy network detection that flags WebRTC/TURN traffic anomalies (e.g., ICE candidate omission forcing TURN-only relay) where feasible via TLS/QUIC fingerprinting or DPI on managed egress
  • Restrict and monitor RMM tool installation (AnyDesk, ScreenConnect, Syncro, Splashtop, OptiTune) via allowlist; alert on any RMM binary not centrally deployed
  • Enforce MFA and out-of-band verification for helpdesk/IT support requests to blunt vishing-driven initial access
  • Maintain offline, immutable backups and test ESXi/Linux/NAS restoration paths given Chaos's cross-platform encryptor

Weaknesses (CWE) in Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

CWE-506

Timeline of Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

  • Chaos ransomware group first observed active, assessed with moderate confidence as a rebrand of, or run by former members of, the BlackSuit (Royal) ransomware operation.
  • Chrome 136 ships restrictions preventing CDP debugging against the default browser profile, which msaRAT later bypasses by launching with a dedicated --user-data-dir.
  • U.S. Department of Justice seizes BlackSuit ransomware operation infrastructure in an international law-enforcement action, coinciding with Chaos's rise.
  • Praetorian researchers publicly demonstrate use of conferencing-platform TURN infrastructure as a C2 relay technique, a precedent for msaRAT's approach.
  • Sansec discovers a WebRTC-based web-skimmer using similar data-channel exfiltration techniques in the wild.
  • AttackIQ and Security Boulevard publish detection-focused profiles of the Chaos RaaS resurgence, corroborating Talos's Chaos group-profile research.
  • Talos researcher Michael Szeliga states host-based detection at browser-launch time is the most reliable detection point and predicts increased future use of browser-mediated C2 techniques, emphasizing behavior-based detection.
  • The Hacker News, BleepingComputer, Help Net Security, and GridinSoft publish coverage summarizing the Talos findings.
  • Cisco Talos publishes full technical analysis 'Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel' with IOCs, ClamAV, and Snort coverage.
  • Cisco Talos discovers msaRAT on a compromised Windows host during a Chaos ransomware intrusion, staged ahead of the ransomware encryptor.

Update history for TL-2026-1663

Sources cited for Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

Threats related to Chaos Ransomware Uses msaRAT to Route C2 Traffic Through

Detection coverage for TL-2026-1663

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1663 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats