Do Son 
Chaos ransomware leak site
At a glance
| Malware family | msaRAT, a Rust remote access trojan |
| Threat actor | Chaos ransomware group (confirmed by Cisco Talos) |
| Target or victims | Windows hosts inside already-breached large organizations; no victim count published |
| Delivery vector | Post-compromise MSI installer disguised as a Windows update |
| Key capabilities | Remote shell, browser hijacking via Chrome DevTools Protocol, WebRTC tunneling, double encryption |
| Source | Cisco Talos research blog |
TL;DR
Cisco Talos has named a new Rust backdoor msaRAT and tied it to the Chaos ransomware group. The msaRAT malware starts a hidden Chrome or Edge process, then drives that browser through the Chrome DevTools Protocol (CDP). Because of that design, every command-and-control byte leaves the machine as ordinary browser traffic.
How attackers deliver msaRAT malware
Delivery happens after the intrusion, not before it. Talos observed operators pulling an MSI installer named “update_ms.msi” onto a compromised Windows host with curl. The request specified port 443, yet the traffic ran over plain HTTP. Firewalls that judge sessions by port number alone let it through.
The installer carries fake vendor details and a product name that mimics a Windows update. For initial access, Chaos relies on spam email and voice phishing. Operators then abuse remote monitoring and management tools to hold their foothold.
Infection chain at a conceptual level
When the MSI reaches its final install stage, a custom action fires. That action loads a DLL stored inside the installer straight into memory. The DLL is msaRAT, and it exposes one exported function for the installer to call.
The RAT first starts the Tokio asynchronous runtime. It reads an environment variable to pick a worker thread count. If that variable is missing, it asks Windows for the CPU count instead.
Next it hunts for a browser. It checks six fixed paths built from environment variables, covering both Chrome and Edge. Should none of them match, it falls back to a registry lookup for Chrome alone. Without a browser on the box, the C2 mechanism never starts at all.
How msaRAT builds its command-and-control channel
After locating a browser, the RAT launches it headless with the remote debugging port enabled. It opens a CDP session over WebSocket, creates a tab, and activates the JavaScript runtime. Then it disables Content Security Policy and registers five callback bindings.
Four of those names — msaOpen, msaClose, msaError and msaMessage — gave the malware its label. The RAT injects JavaScript that fetches ICE server settings from a Cloudflare Workers endpoint. The browser then trades an SDP offer and answer with the attacker’s server.
Why the traffic is hard to spot
Talos puts it plainly: “msaRAT never touches the network directly.” The RAT process itself only speaks to loopback. Everything outbound comes from a legitimate browser process.
The attacker’s SDP answer arrives with no ICE candidates at all. Peer-to-peer therefore never happens, and all data runs through a Twilio TURN relay. As a result, the attacker’s real server address stays out of the packet capture.
Encryption and data handling
Shell command frames arrive over the channel and execute on the host. Output returns along the same path. A send queue holds frames until the browser buffer drops below 24KB, which supports bulky transfers such as screenshots.
Two encryption layers wrap the content. The browser applies DTLS by specification, while msaRAT adds ChaCha20-Poly1305 keyed through an ECDH exchange. Even a stripped DTLS session still yields nothing readable.
Attribution is confirmed, not suspected
Talos attributes msaRAT to the Chaos ransomware group directly. This is vendor-confirmed attribution rather than a working theory. Chaos surfaced in February 2025 as a ransomware-as-a-service operation, and it is unrelated to the older family that shares the name.
Rapid7 reported earlier that Iranian actor MuddyWater borrowed the Chaos brand as a false flag. That episode is separate from this one. Talos also published no file hashes and no victim figures, so the public indicator set covers two network artifacts only.
Detection and defense guidance
Host telemetry beats network filtering here. Help Net Security quoted a Talos researcher saying “the most reliable place to catch this is at the host.” Network monitoring sees encrypted WebRTC and little else.
Hunt for these behaviours instead:
- A browser launched with a remote debugging port flag
- A headless browser started with a custom user-data directory
- Browser processes spawned by an installer or service, not a user
- MSI packages dropped into ProgramData and run moments later
- WebRTC sessions from hosts that never run video calls
Blocking workers.dev or Twilio wholesale will break real services, so treat that option carefully. Restricting debugger flags through browser policy is a safer control. For signatures and the full technical breakdown, read the Cisco Talos research write-up on msaRAT.
The delivery half of this chain is old news. What changed is where the C2 lives afterward, and browsers are now part of the attack surface teams must watch.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
