New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

The sophisticated msaRAT backdoor, a recent development attributed to the notorious Chaos ransomware gang, has been identified employing an innovative technique to conceal its command-and-control (C2) communications by routing them covertly through legitimate Chrome or Microsoft Edge browser sessions. This novel approach, detailed by security researchers, significantly lowers the risk of detection by embedding malicious traffic within seemingly innocuous web activity, presenting a formidable challenge for network defenders.

Technical Deep Dive: The Stealth of msaRAT

Written in the high-performance Rust programming language, msaRAT leverages the Chrome DevTools Protocol (CDP) to orchestrate a headless browser session. A headless browser operates without a visible graphical user interface, making it an ideal tool for automation, testing, and, in this malicious context, covert operations. By manipulating a browser in this manner, msaRAT establishes an encrypted, indirect connection to the attacker’s server, circumventing many traditional network security measures designed to flag direct, suspicious outbound connections. The choice of Rust is noteworthy; its memory safety features reduce certain classes of vulnerabilities, while its performance and ability to compile to native code make it a powerful choice for malware developers seeking efficiency and evasion.

The core ingenuity of msaRAT lies in its ability to avoid any direct interaction with the C2 infrastructure from the host system. Instead, all communication is funneled through the hijacked browser process. This method exploits the trust inherent in web browsers and the legitimate traffic they generate, allowing malicious data to blend seamlessly with regular user activity, thereby drastically reducing its network footprint and the likelihood of detection by signature-based or anomaly-detection systems.

The Evolution of the Chaos Ransomware Group

The Chaos ransomware group, which re-emerged in early 2025, should not be confused with an earlier, similarly named ransomware family active since 2021. This distinction is crucial for accurate threat attribution and analysis. The current iteration of Chaos has demonstrated increasing sophistication in its tactics, techniques, and procedures (TTPs). Earlier this year, researchers at Rapid7 uncovered a significant link, revealing that Chaos was being utilized by ‘MuddyWater,’ an Iranian state-backed advanced persistent threat (APT) group. In these instances, Chaos ransomware served as a strategic decoy, masking MuddyWater’s primary objective of cyber-espionage and data exfiltration under the guise of financially motivated attacks. This tactic of misdirection is a common hallmark of state-sponsored operations seeking to obscure their true identity and intentions.

More recent campaigns observed by the Cisco Talos research team indicate a refined infection chain. These attacks frequently initiate through targeted social engineering efforts, specifically email or voice phishing. Successful phishing attempts lead to the installation of remote management software, such as TeamViewer or AnyDesk, providing attackers with persistent access to the compromised environment. Once a foothold is established, the attackers proceed to download and execute an MSI installer. This installer, often disguised as a routine Windows update, covertly loads the msaRAT backdoor (typically identified as lib.dll) directly into system memory. This in-memory execution technique further complicates detection, as it avoids leaving persistent artifacts on disk that traditional endpoint security solutions might flag.

The Infection Chain and Browser Hijacking in Detail

The journey from initial compromise to active C2 communication is a multi-step process engineered for stealth and resilience:

1. Initial Access: Attackers gain entry primarily through email or voice phishing, tricking victims into executing malicious payloads or revealing credentials.
2. Persistence: Remote management software is installed, granting the attackers sustained access to the compromised system.
3. Payload Delivery: An MSI installer, masquerading as a benign system update, is deployed.
4. In-Memory Execution: The MSI installer loads lib.dll (msaRAT) directly into system memory, bypassing disk-based detection mechanisms.
5. Browser Selection: Once active, msaRAT systematically searches for installed Chrome or Microsoft Edge browsers.
6. Headless Launch: The malware launches the identified browser in a headless mode, meaning the browser process runs in the background without any visible window or user interface, operating entirely covertly.
7. CDP Activation: msaRAT then enables the browser’s remote debugging interface, connecting to it via the Chrome DevTools Protocol (CDP). CDP is a legitimate, powerful API used by developers for debugging and inspecting web content, but it offers a potent vector for malicious control when abused.
8. JavaScript Injection: A new browser tab is opened within the headless session, and specialized JavaScript code is injected into it using CDP commands. This injected script is foundational for establishing and managing the clandestine communication channel.
9. CSP Bypass: Crucially, the injected JavaScript is designed to bypass Chrome’s Content Security Policy (CSP). CSP is a browser security layer intended to prevent cross-site scripting (XSS) and other code injection attacks by restricting which resources a web page can load. The malware’s ability to circumvent CSP highlights a sophisticated understanding of browser internals and security mechanisms.
10. CDP Binding Registration: The script registers several CDP bindings, which are essentially hooks that allow the malware to control various browser functions and manage the C2 communications.

The Dual-Layered Communication Scheme: Obfuscation and Resilience

Once the initial browser setup is complete, the hijacked browser initiates contact with a Cloudflare Workers endpoint (e.g., is-01-ast[.]ols-img-12[.]workers[.]dev). Cloudflare Workers are serverless functions that run on Cloudflare’s global edge network, providing legitimate developers with a powerful platform for deploying applications. In this context, the Workers endpoint serves as a critical signaling relay, facilitating the exchange of WebRTC connection information. WebRTC (Web Real-Time Communication) is an open-source project that provides browsers and mobile applications with real-time communication capabilities via simple APIs.

The communication channel established by msaRAT exhibits a robust, dual-layered encryption scheme:

1. WebRTC DTLS: The first layer of encryption is provided automatically by the browser through DTLS (Datagram Transport Layer Security), which secures the WebRTC connection.
2. ChaCha20-Poly1305 + ECDH: The second, custom layer of encryption is implemented by msaRAT itself, utilizing ChaCha20-Poly1305 for authenticated encryption and Elliptic Curve Diffie-Hellman (ECDH) for secure key exchange. This combination of strong, modern cryptographic primitives ensures that even if the WebRTC layer is compromised, the inner communication remains protected.

The data exchange system is meticulously structured, breaking down messages into "frames." These frames encapsulate various commands and information, including key exchanges, channel opening and closing, session resets, and crucially, Windows command execution. This structured approach allows for precise and robust control over the compromised system.

Abusing Legitimate Services: Twilio and Cloudflare

A key aspect of msaRAT’s evasiveness is its strategic abuse of legitimate, widely trusted services. Communication is not only encrypted but also relayed through Twilio TURN (Traversal Using Relays around NAT) servers. TURN servers are a standard component of WebRTC, enabling real-time communication between peers that are behind network address translators (NATs) or firewalls. However, msaRAT employs a specific configuration to prevent direct peer-to-peer (P2P) connections. By intentionally omitting the ICE (Interactive Connectivity Establishment) candidates that are normally present in standard WebRTC communications, the malware forces all traffic to be routed through Twilio’s TURN servers.

This deliberate design ensures that:

• Anonymity: The real IP address of the attacker’s C2 server never directly appears in the network traffic, as all communication is proxied through Twilio’s legitimate infrastructure.
• Evasion: Routing traffic through well-known, legitimate services like Twilio and Cloudflare makes it exceedingly difficult for security appliances to differentiate malicious C2 traffic from benign enterprise network traffic. Firewalls and allowlists are unlikely to block traffic destined for these services due to their pervasive use in legitimate business operations.

Cisco Talos researchers emphasized the significant challenge posed by this dual-layer infrastructure: "By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Workers makes it significantly difficult to trace the attacker’s infrastructure."

Furthermore, the use of Cloudflare Workers as the signaling relay provides additional layers of protection for the attackers. The destination IP address observed by defenders will be that of Cloudflare’s infrastructure, which automatically passes many firewall and allowlist verifications. The *.workers.dev free subdomain, assigned to developers, presents a particular dilemma for network administrators. Blocking this subdomain outright would disrupt a vast number of legitimate Cloudflare Workers deployments and affect benign services, making it an impractical detection and mitigation strategy.

Broader Impact and Implications for Cybersecurity

The emergence of msaRAT underscores a concerning trend in the evolution of sophisticated malware: the increasing reliance on legitimate infrastructure and protocols for covert operations. This strategy fundamentally challenges traditional network security paradigms that often focus on blocking known malicious IP addresses or identifying anomalous network patterns. When C2 traffic is indistinguishable from normal web browsing, it necessitates a shift in defensive strategies.

• Detection Challenges: Security teams face immense difficulty in distinguishing msaRAT’s C2 traffic from legitimate browser activity. This necessitates more advanced behavioral analytics, endpoint detection and response (EDR) capabilities that can monitor process-level activity, and deeper visibility into browser processes and their interactions with system resources.
• Endpoint Focus: Given the in-memory execution and browser hijacking, endpoint security becomes paramount. Organizations must prioritize robust EDR solutions capable of detecting living-off-the-land techniques, unusual CDP usage, and memory injection.
• Supply Chain Abuse: The weaponization of legitimate web services like Cloudflare and Twilio highlights a broader risk of supply chain abuse, where trusted third-party platforms become unwitting conduits for malicious activity.
• Zero Trust Imperative: This development reinforces the critical need for Zero Trust architectures, where no user, device, or application is inherently trusted, regardless of its location or apparent legitimacy. Every connection and request must be authenticated and authorized.
• Threat Intelligence: The detailed Indicators of Compromise (IoCs) provided by Cisco Talos, available on their GitHub repository, are invaluable for organizations to proactively identify and block components associated with msaRAT attacks. These IoCs typically include file hashes, domain names, and IP addresses used in the attack infrastructure.

Official Responses and Mitigation Strategies

While specific "official responses" from government bodies are typically reserved for major, widespread incidents, the detailed analysis from leading cybersecurity research firms like Cisco Talos and Rapid7 serves as a critical alert to the industry. These reports act as a call to action for organizations to bolster their defenses.

To mitigate the threat posed by msaRAT and similar sophisticated backdoors, organizations should implement a multi-layered security approach:

1. Enhanced Phishing Defenses: Implement advanced email filtering, DMARC, DKIM, and SPF protocols, and conduct regular security awareness training for employees to identify and report phishing attempts, whether via email or voice.
2. Robust Endpoint Security: Deploy advanced EDR solutions with behavioral analytics, memory forensics capabilities, and the ability to monitor browser process integrity and unusual API calls (like CDP).
3. Network Segmentation: Segment networks to limit lateral movement and contain breaches, making it harder for attackers to establish persistence and reach critical assets.
4. Patch Management: Ensure all operating systems, applications, and web browsers are regularly updated to patch known vulnerabilities that could be exploited for initial access or privilege escalation.
5. Application Whitelisting: Implement application whitelisting to restrict the execution of unauthorized software, including remote management tools not explicitly approved.
6. Proactive Threat Hunting: Security teams should actively hunt for signs of compromise, looking for unusual browser activity, unauthorized remote access tools, or suspicious MSI installer executions.
7. Web Proxy and DNS Monitoring: While challenging, advanced web proxies and DNS monitoring solutions might be configured to look for anomalies in traffic patterns to legitimate services, though this requires highly sophisticated tuning.
8. Principle of Least Privilege: Enforce the principle of least privilege for all users and services, limiting the potential impact of a compromised account.

The msaRAT backdoor represents a significant advancement in evasion techniques, leveraging the trusted ecosystem of web browsers and legitimate cloud services to establish a stealthy and resilient C2 channel. Its discovery by Cisco Talos provides critical intelligence for the cybersecurity community, highlighting the ongoing need for adaptive defense strategies and a proactive stance against an ever-evolving threat landscape.