The victim’s browser served as the command-and-control mechanism used by the Chaos ransomware gang. The Rust implant msaRAT, which was discovered on a compromised Windows computer before the encryptor, was described by Cisco Talos on Thursday.
The implant never establishes an independent outbound link. Its process only communicates with 127.0.0.1. It launches Chrome or Edge in headless mode and uses the browser’s debugging API, the Chrome DevTools Protocol.
A defender sees a browser contacting Cloudflare and Twilio on the wire since each C2 communication leaves via a WebRTC data channel that is routed by Twilio’s TURN service. There is never any mention of the attacker’s own server IP.
msaRAT first searches the environment variables for Chrome or Edge before returning to the registry for Chrome. The CDP path is omitted if there is no browser that matches.
When it locates one, it uses –headless=new to launch the browser without a visible window, enables CDP with –remote-debugging-port, and points it at a different read more about Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.