New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser se…
Intelligence analysis by Llama
The msaRAT malware uses Chrome or Edge browsers to route C2 traffic, making it difficult to detect. The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker's server.
Imagine you're trying to send a secret message to your friend, but you don't want anyone to know about it. You use a special way of sending the message through a website, like Google Chrome or Microsoft Edge, so that it looks like a normal web page. This makes it harder for others to detect the secret message. That's basically what the msaRAT malware does, but instead of sending a message, it's used by hackers to control their computers remotely.
Analysis
A New Twist in C2 Communication
The Chaos ransomware gang has been making headlines with its innovative tactics, and the latest development is no exception. The group has been using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. This approach is a significant departure from traditional C2 communication methods, which often involve direct connections to the attacker's server.
The msaRAT malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker's server. This allows the malware to communicate with the attacker's server without making any direct connections, making it more difficult to detect.
How msaRAT Works
The msaRAT malware searches for Chrome or Microsoft Edge and launches the browser in headless mode. It then enables the browser's remote debugging interface and connects to it via CDP. After this step, it opens a new browser tab and injects JavaScript into it using CDP commands. The injected JavaScript is responsible for building the communication channel, bypassing Chrome's Content Security Policy (CSP), and registering several CDP bindings that enable communications.
The Communication Mechanism
The communication mechanism in msaRAT allows it to control the C2 exchanges without touching the network directly and bury it within normal web traffic. The malware uses Cloudflare Workers as the signaling relay, ensuring that the attacker's server remains protected as the destination IP address is assigned to Cloudflare's infrastructure and will pass firewall and allowlist automatic verification. The '*workers.dev' free subdomain is assigned for developers, and blocking it would disrupt legitimate Cloudflare Workers deployments and affect benign services.
Implications
The use of msaRAT by the Chaos ransomware gang has significant implications for security teams. The malware's ability to route C2 traffic through Chrome or Edge browsers makes it challenging to detect and respond to the threat. This approach also highlights the evolving tactics of the gang, which is constantly adapting to evade detection. Security teams must be vigilant and stay up-to-date with the latest threats and tactics to effectively respond to emerging threats like msaRAT.
Key points
- The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.
- The msaRAT malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker's server.
- The malware uses Cloudflare Workers as the signaling relay, ensuring that the attacker's server remains protected as the destination IP address is assigned to Cloudflare's infrastructure and will pass firewall and allowlist automatic verification.
- The use of msaRAT by the Chaos ransomware gang has significant implications for security teams, making it challenging to detect and respond to the threat.
If this development plays out positively, it could lead to the development of more sophisticated security measures that can detect and respond to emerging threats like msaRAT. This could also lead to a greater understanding of the tactics and techniques used by hackers, allowing security teams to stay one step ahead.
On the other hand, the use of msaRAT by the Chaos ransomware gang could lead to a significant increase in the number of undetected attacks, as the malware's ability to route C2 traffic through Chrome or Edge browsers makes it challenging to detect. This could also lead to a greater reliance on traditional security measures, which may not be effective against emerging threats like msaRAT.
