408/69 Friday, July 24, 2026
The Chaos ransomware group has been observed using a new backdoor called msaRAT, developed in Rust, which abuses the Chrome DevTools Protocol (CDP) to control Google Chrome or Microsoft Edge for relaying communications with command-and-control (C2) servers instead of connecting directly from the malware itself. This causes the traffic to resemble normal web activity and reduces the chance of detection by security systems.
Reports indicate that the attack begins with phishing emails or voice phishing, followed by the installation of remote management software to establish persistence on the system. The attackers then download an MSI installer disguised as a Windows update to load msaRAT into memory. Once executed, the malware launches Chrome or Edge in headless mode, running the browser without displaying a visible window. It then uses CDP to inject JavaScript and create a communication channel with the C2 server. The process starts by contacting a Cloudflare Workers endpoint to obtain information needed to establish a WebRTC connection, before transmitting data through Twilio TURN. This prevents the attacker’s server IP address from appearing in the victim’s network traffic and makes it more difficult to detect and trace the attacker’s infrastructure.
Organizations should monitor for the unexpected use of Chrome or Microsoft Edge in headless mode, especially when it does not align with normal system behavior. They should also inspect Chrome DevTools Protocol activity and abnormal WebRTC connections originating from internal systems. Cisco Talos has published indicators of compromise (IOCs) to support detection and monitoring of activity related to msaRAT. These indicators should be used together with EDR systems and network traffic analysis to improve threat detection capability.