The cybersecurity landscape is currently contending with a sophisticated new threat as the Chaos ransomware gang has deployed a novel backdoor identified as msaRAT. This malware represents a significant shift in evasion tactics, utilizing legitimate web browser processes—specifically Google Chrome and Microsoft Edge—to mask its command-and-control (C2) communications. By routing malicious traffic through these ubiquitous applications, the threat actors have created a communication channel that is exceptionally difficult for traditional network security tools to distinguish from legitimate user activity.
The discovery, detailed in a comprehensive report by the Cisco Talos research team, highlights a growing trend among cybercriminal organizations: the repurposing of legitimate developer tools and web protocols to bypass modern defense-in-depth strategies. The msaRAT backdoor, written in the Rust programming language, leverages the Chrome DevTools Protocol (CDP) to manipulate headless browser sessions, effectively turning a victim’s workstation into a relay for encrypted communication with attacker-controlled infrastructure.
Technical Architecture and the Use of Rust
The choice of Rust for the development of msaRAT is noteworthy. In recent years, malware authors have increasingly migrated toward memory-safe languages like Rust and Go. This shift is driven by several factors, including the language’s ability to produce highly efficient, cross-platform binaries that are often more difficult for legacy antivirus engines to signature-match compared to traditional C++ or C# malware.
In the case of msaRAT, the malware’s primary function is to establish a persistent and stealthy foothold within a compromised network. Once executed, the backdoor does not attempt to contact its C2 server directly. Instead, it searches the host system for installations of Google Chrome or Microsoft Edge. Upon locating a compatible browser, it initiates a "headless" instance. A headless browser is a web browser without a graphical user interface, typically used by developers for automated testing and web scraping. In this context, however, it serves as an invisible vessel for data exfiltration and command reception.
The Chrome DevTools Protocol Exploitation
The core innovation of msaRAT lies in its exploitation of the Chrome DevTools Protocol (CDP). CDP is a powerful interface that allows developers to instrument, inspect, debug, and profile Chromium-based browsers. By connecting to the browser via this protocol, msaRAT gains total control over the browser’s internal workings.
According to technical analysis, the malware enables the remote debugging interface of the headless browser and establishes a connection. It then opens a new, invisible tab and uses CDP commands to inject custom JavaScript directly into the session. This injected code is responsible for the heavy lifting of the communication process. It bypasses the browser’s Content Security Policy (CSP)—a security layer designed to prevent cross-site scripting and data injection attacks—and registers specific CDP bindings that facilitate the transfer of data between the malware and the browser.
This "living-off-the-browser" technique ensures that the network traffic generated by the malware appears to originate from a legitimate chrome.exe or msedge.exe process. For many security solutions, traffic from these processes is often given a higher level of trust, as it is expected to consist of standard HTTPS requests to various web services.
A Multi-Layered Infrastructure: WebRTC, Cloudflare, and Twilio
The sophistication of msaRAT extends beyond the local host to its external communication infrastructure. To further obfuscate the destination of the stolen data and the source of incoming commands, the attackers have implemented a complex relay system involving several legitimate cloud services.
Once the headless browser session is established and the JavaScript is injected, the malware initiates a connection to a Cloudflare Workers endpoint. Cloudflare Workers is a serverless platform that allows developers to run code at the "edge" of the internet. By using a workers.dev subdomain, the attackers ensure that the initial network request is directed toward a trusted Cloudflare IP address. Blocking these subdomains is often impractical for enterprises, as they are widely used for legitimate business applications.
The Cloudflare endpoint serves as a signaling relay, providing the malware with the necessary information to establish a WebRTC connection. WebRTC (Web Real-Time Communication) is a protocol primarily used for voice and video calling in browsers. However, msaRAT repurposes it for data transfer.
The communication chain is further complicated by the use of Twilio TURN (Traversal Using Relays around NAT) servers. TURN servers are designed to help media bypass restrictive firewalls by relaying traffic through a central point. The msaRAT configuration is specifically tuned to avoid direct peer-to-peer connections. By intentionally omitting "ICE candidates" that would normally allow for a direct connection between the victim and the attacker, the malware forces all traffic through the Twilio relay.
This architecture provides the attackers with two major advantages:
- IP Masking: The actual IP address of the attacker’s command-and-control server is never exposed to the victim’s network. All traffic is seen going to Cloudflare or Twilio.
- Encryption Redundancy: The traffic is protected by two layers of encryption. First, the standard WebRTC DTLS encryption provided by the browser, and second, a custom layer implemented by msaRAT using ChaCha20-Poly1305 and ECDH (Elliptic Curve Diffie-Hellman) key exchange.
Chronology of an Attack: From Phishing to Memory Persistence
The deployment of msaRAT is the culmination of a multi-stage infection chain. Observations by Cisco Talos indicate that the Chaos ransomware gang typically begins its operations with social engineering.
- Initial Access: The attack often starts with email or voice phishing (vishing). In these scenarios, attackers pose as IT support or service providers to trick employees into granting remote access or downloading malicious files.
- Persistence: Once initial access is gained, the attackers install legitimate remote management and monitoring (RMM) software. This allows them to maintain access to the environment even if the initial entry point is closed.
- The Fake Update: With a foothold established, the attackers deploy a malicious MSI installer. This installer is frequently disguised as a critical Windows update to avoid suspicion from the end-user.
- Memory Loading: Instead of writing the msaRAT executable to the disk in a traditional manner, the MSI installer loads the malware’s core component, a library named
lib.dll, directly into the system’s memory. This "fileless" approach is designed to evade signature-based detection from antivirus software that primarily scans the physical hard drive.
Historical Context: The Chaos Ransomware Gang and MuddyWater
The entity behind msaRAT, the Chaos ransomware group, is a relatively new player in the threat landscape, having emerged in early 2025. Researchers have been quick to distinguish this group from a previous ransomware family of the same name that was active starting in 2021. The modern Chaos gang appears to be more sophisticated and focused on high-value targets.
There is also a significant geopolitical dimension to the group’s activities. Earlier in 2025, researchers at Rapid7 linked the use of Chaos ransomware to "MuddyWater," a prominent threat actor group backed by the Iranian state. MuddyWater has historically been associated with cyber-espionage operations.
In several observed cases, the deployment of Chaos ransomware appeared to be a "false flag" or a decoy. By launching a ransomware attack—which is typically viewed as a financially motivated crime—the state-backed actors can obscure their true objective: the long-term surveillance and theft of sensitive intelligence. If an organization believes it has simply been the victim of a random ransomware attack, it may focus on recovery rather than investigating whether its data has been quietly exfiltrated over several months.
Implications for Corporate Security and Detection
The emergence of msaRAT highlights a critical challenge for modern Security Operations Centers (SOCs). Traditional defense strategies that rely on blocking known malicious IP addresses or flagging suspicious network protocols are increasingly insufficient.
By using WebRTC and routing traffic through Cloudflare and Twilio, the attackers are "hiding in plain sight." Their traffic is encrypted, it uses standard web ports (443), and it terminates at some of the most trusted infrastructure providers on the internet.
The Cisco Talos report emphasizes that the communication mechanism in msaRAT allows it to control the C2 exchanges without ever touching the network stack directly. Because the malware interacts with the browser via an internal protocol (CDP) and let the browser handle the external networking, the malware itself generates very little anomalous telemetry at the operating system level.
Fact-Based Analysis of the Threat Landscape
The development of msaRAT is indicative of a broader trend toward "Browser-as-a-Service" exploitation in the malware world. As endpoint detection and response (EDR) solutions become more adept at monitoring process behavior and API calls, attackers are moving their logic into the browser environment, where monitoring is often less granular.
The use of headless browsers for C2 is not entirely new, but the integration of CDP for dynamic JavaScript injection and the use of WebRTC for data exfiltration represents a high degree of technical maturity. This approach effectively bypasses many of the heuristics used by network firewalls and web proxies.
Furthermore, the reliance on Cloudflare Workers and Twilio demonstrates a strategic understanding of corporate network policies. Most enterprises cannot afford to block Cloudflare or Twilio without disrupting essential business services. This creates a "permanent" gap in the perimeter that attackers can exploit.
Conclusion and Defensive Recommendations
The msaRAT backdoor serves as a potent reminder that the tools used to build and test the modern web can be turned into weapons by sophisticated threat actors. The Chaos ransomware gang’s ability to blend malicious traffic with the noise of everyday web browsing poses a significant risk to organizations across all sectors.
To defend against such threats, security professionals are encouraged to move beyond simple perimeter defenses. Recommendations include:
- Enhanced Endpoint Monitoring: Implementing EDR solutions that can detect the unauthorized spawning of headless browser processes and monitor for unusual use of the Chrome DevTools Protocol.
- Behavioral Analysis: Focusing on the behavior of processes rather than just their identity. A browser process that maintains a persistent WebRTC connection to a cloud service while having no visible window should be treated as a high-severity alert.
- Strict Software Policies: Limiting the ability of standard users to run MSI installers or install remote management tools.
- User Training: Continued education on the risks of phishing and vishing, as these remains the primary entry points for even the most technically advanced malware.
Cisco Talos has released a full list of Indicators of Compromise (IoCs), including file hashes and the specific Cloudflare Worker subdomains used in the campaign. Organizations are urged to cross-reference these indicators with their own network logs to ensure that they have not been targeted by the msaRAT backdoor. As the line between legitimate web activity and malicious communication continues to blur, the importance of deep-visibility security tools has never been greater.
