The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.
The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker’s server.
Since the malware routes all communication through the browser, it does not make any direct connection to the C2 infrastructure, significantly lowering the risk of detection.
The Chaos ransomware group emerged in early 2025, unrelated to the same-named ransomware family that existed since 2021.
Earlier this year, researchers at Rapid7 found that Chaos was leveraged by Iranian state-backed hackers ‘MuddyWater’ to disguise their cyber-espionage operations as financially motivated attacks.
More recent Chaos ransomware attacks observed by the Cisco Talos research team started through email or voice phishing and continued with the installation of remote management software to establish persistence.
Once inside the environment, the attacker downloaded an MSI installer posing as a Windows update, which loads msaRAT (lib.dll) directly in system memory.
Next, it enables the browser’s remote debugging interface and connects to it via CDP. After this step, it opens a new browser tab and injects JavaScript into it using CDP commands.
The injected JavaScript is responsible for building the communication channel, bypassing Chrome’s Content Security Policy (CSP), and registering several CDP bindings that enable communications.
Once the initial setup is complete, the browser contacts a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to obtain WebRTC connection information and establish an encrypted channel.
Talos explains that there are two layers of encryption: the WebRTC DTLS, automatically provided by the browser, and ChaCha20-Poly1305 + ECDH key, implemented by msaRAT.
Communication is relayed through Twilio TURN (Traversal Using Relays around NAT) servers with a specific configuration to avoid direct peer-to-peer connections.
“By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN,” explains Cisco.
“By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Cisco Confidential Workers makes it significantly difficult to trace the attacker’s infrastructure.”
The researchers documented how the data exchange system works by breaking down messages into chunks called “frames,” which include key exchanges, channel opening/closing, session resets, and Windows command execution.
By using Cloudflare Workers as the signaling relay, the attacker ensures that their server remains protected as the destination IP address is assigned to Cloudflare’s infrastructure and will pass firewall and allowlist automatic verification.
Also, the “*workers.dev” free subdomain is assigned for developers and blocking it would disrupt legitimate Cloudflare Workers deployments, and affect benign services.
The researchers underline that the communication mechanism in msaRAT allows it to control the C2 exchanges without touching the network directly and bury it within normal web traffic.
The report from Cisco Talos shares a complete list of indicators of compromise (IoCs) associated with attacks using the msaRAT backdoor attacks.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
AsyncAPI npm packages infected with credential-stealing malware
WordPress malware campaign hides payloads in Steam profiles
FakeGit campaign uses 7,600 GitHub repos to push SmartLoader malware
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms
Microsoft warns of surge in ACR Stealer attacks on customers
Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
Hugging Face warns an autonomous AI agent hacked its network
Critical ServiceNow code execution flaw now exploited in attacks
See how Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Read the case study.
Do you have what it takes to challenge DARKROOM? Signup for an exclusive DEFCON CTF!
Privacy by policy or privacy by architecture? See how age checks work when the face never leaves the device.
Overdue a password health-check? Audit your Active Directory for free
AI agents can speed up ransomware attacks. See how Acronis helps reduce the risk.
Calculate what you’d save by replacing your MDR.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
