Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
The victim's browser served as the command-and-control mechanism used by the Chaos ransomware gang. The Rust implant msaRAT, which was discovered on a compromised Windows computer before the encryptor, was described by Cisco Talos on Thursday.
The implant never establishes an independent outbound link. Its process only communicates with 127.0.0.1. It launches Chrome or Edge in headless mode and uses the browser's debugging API, the Chrome DevTools Protocol.
A defender sees a browser contacting Cloudflare and Twilio on the wire since each C2 communication leaves via a WebRTC data channel that is routed by Twilio's TURN service. There is never any mention of the attacker's own server IP.
msaRAT first searches the environment variables for Chrome or Edge before returning to the regi...