Chaos Ransomware Gang Leverages New msaRAT Backdoor to Obfuscate Command-and-Control Traffic Through Web Browsers
The burgeoning threat landscape has witnessed the emergence of a sophisticated new backdoor malware, dubbed msaRAT, employed by the notorious Chaos ransomware gang. This novel malware distinguishes itself by artfully concealing its command-and-control (C2) communications, routing them through widely used web browsers such as Google Chrome and Microsoft Edge. This ingenious evasion technique significantly complicates detection efforts, allowing the attackers to operate with a reduced risk of being identified by security defenses. The malware’s architecture, written in the Rust programming language, harnesses the Chrome DevTools Protocol (CDP) to meticulously control a headless browser instance, thereby establishing a covert connection to the adversary’s infrastructure. By seamlessly integrating its C2 traffic within legitimate browser operations, msaRAT effectively bypasses the typical network monitoring tools that would flag direct, anomalous connections to external servers.
The Chaos ransomware group itself is a relatively new entrant to the cybercrime scene, having first gained prominence in early 2025. It is crucial to distinguish this iteration from an earlier ransomware family bearing the same name, which had been active since 2021. This newer incarnation of Chaos has already demonstrated a concerning level of sophistication and adaptability. Earlier in the year, researchers from Rapid7 brought to light the association of the Chaos ransomware with state-backed Iranian hacking collective, often referred to as "MuddyWater." In those instances, Chaos ransomware was reportedly utilized as a diversionary tactic, intended to mask more pervasive cyber-espionage operations conducted by the group. This strategic use of ransomware as a decoy underscores the evolving tactics of nation-state actors seeking to obscure their true intentions.
More recent observations of Chaos ransomware attacks, meticulously documented by the Cisco Talos research team, reveal a consistent infection vector. These attacks typically commence with carefully orchestrated phishing campaigns, either through email or voice phishing (vishing), aimed at tricking unsuspecting individuals into compromising their systems. Following successful initial compromise, the attackers proceed to install remote management software, a critical step in establishing a persistent foothold within the victim’s network. This persistent access allows the adversaries to maintain a covert presence, enabling them to exfiltrate data, deploy further malicious payloads, or prepare for ransomware deployment.
The infiltration process often involves the clandestine download of a malicious MSI (Microsoft Installer) package. This installer is deceptively presented as a routine Windows update, a common tactic designed to exploit users’ trust in system updates. Once executed, this MSI package is engineered to load the msaRAT backdoor directly into the system’s memory, bypassing traditional disk-based detection mechanisms. The library file, typically named "lib.dll," is injected and executed in-memory, making it harder for endpoint security solutions to identify and quarantine.
Hijacking the Browser for Covert Communications
The core innovation of msaRAT lies in its sophisticated exploitation of web browser functionalities. Upon activation, the malware actively searches for instances of Google Chrome or Microsoft Edge installed on the compromised system. It then initiates the launch of these browsers in "headless mode." Headless operation means the browser process runs in the background without any visible graphical user interface, making its activity virtually undetectable to the end-user.
Following the headless launch, msaRAT proceeds to enable the browser’s remote debugging interface. This interface, normally used by developers for troubleshooting and testing web applications, is a powerful tool that allows external control over the browser. The malware then establishes a connection to this debugging interface using commands facilitated by the Chrome DevTools Protocol (CDP). This protocol acts as a bridge, enabling the malware to send instructions and receive data from the browser instance it controls.
The next critical step involves the creation of a new browser tab within the headless instance. Into this tab, msaRAT injects custom JavaScript code using CDP commands. This injected script plays a pivotal role in constructing the communication channel. It is designed to circumvent the browser’s Content Security Policy (CSP), a security feature that restricts the resources a web page can load, thereby preventing unauthorized scripts from executing. Furthermore, the JavaScript registers several CDP bindings. These bindings act as communication endpoints, enabling bidirectional data flow between the msaRAT malware and the browser.
Establishing a Dual-Layered Encrypted Tunnel
Once the initial setup is complete and the communication channel is established within the browser, msaRAT initiates contact with a specific Cloudflare Workers endpoint. This endpoint, identified as is-01-ast[.]ols-img-12[.]workers[.]dev, serves as a signaling relay. Its primary function is to obtain the necessary information for establishing a WebRTC (Web Real-Time Communication) connection. WebRTC is a technology designed for real-time communication applications, such as video conferencing and peer-to-peer file sharing, and it inherently provides a secure communication framework.
The security of the communication is further bolstered by a robust, dual-layered encryption scheme. The first layer of encryption is provided by WebRTC’s DTLS (Datagram Transport Layer Security) protocol, which is automatically handled by the browser. This provides a foundational level of security for the real-time data transmission. On top of this, msaRAT implements its own encryption using the ChaCha20-Poly1305 cipher, combined with Elliptic Curve Diffie-Hellman (ECDH) key exchange. This sophisticated combination ensures that even if the DTLS layer were somehow compromised, the data would remain unreadable due to the malware’s own robust encryption.
The communication traffic is then relayed through Twilio TURN (Traversal Using Relays around NAT) servers. Twilio is a legitimate cloud communications platform, and its TURN servers are designed to facilitate network traversal for applications that require peer-to-peer connections, even when direct connections are blocked by firewalls or Network Address Translation (NAT). However, msaRAT employs a specific configuration to prevent direct peer-to-peer (P2P) connections.
Sophisticated Evasion Through Legitimate Services
Cisco Talos researchers highlighted a key aspect of this evasion technique: "By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN." This deliberate manipulation ensures that all data packets pass through Twilio’s infrastructure, rather than attempting a direct connection between the compromised host and the attacker’s server.
The strategic use of legitimate services like Cloudflare Workers and Twilio TURN servers is central to msaRAT’s stealth capabilities. "By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Cisco Confidential Workers makes it significantly difficult to trace the attacker’s infrastructure," the researchers explained. This approach effectively masks the true origin of the C2 traffic, making attribution and takedown operations considerably more challenging.
The researchers meticulously documented the intricate data exchange mechanism employed by msaRAT. The system operates by segmenting data into discrete units referred to as "frames." These frames encapsulate various critical communication elements, including key exchanges for establishing encrypted sessions, commands for opening and closing communication channels, requests for session resets, and, crucially, instructions for executing Windows commands on the compromised system. The interpretation of these frames provides invaluable insights into the malware’s operational logic and its capabilities.
Leveraging Cloudflare Workers for Anonymity
The choice of Cloudflare Workers as the signaling relay is particularly astute. Cloudflare’s infrastructure is widely trusted and often whitelisted by corporate firewalls and security policies. By using a workers.dev subdomain, the attacker ensures that the destination IP address is attributed to Cloudflare’s global network. This bypasses many automated firewall rules and allows the malicious traffic to blend seamlessly with legitimate web traffic. Furthermore, the workers.dev free subdomain is intended for developers and legitimate services. Blocking traffic to this subdomain would inevitably disrupt legitimate Cloudflare Workers deployments, potentially impacting numerous benign services. This creates a disincentive for security teams to implement broad blocking rules that could cause collateral damage.
The effectiveness of msaRAT’s communication mechanism lies in its ability to manage C2 exchanges without making any direct, identifiable network connections. The malicious traffic is effectively buried within the voluminous stream of normal web traffic, rendering it virtually invisible to conventional network monitoring tools. This stealthy approach represents a significant advancement in the techniques employed by ransomware gangs to maintain control over compromised systems.
Broader Implications and Ongoing Threat
The Cisco Talos report provides a comprehensive list of Indicators of Compromise (IoCs) associated with msaRAT-driven attacks. These IoCs include specific network addresses, file hashes, and registry keys that security professionals can utilize to detect and defend against this evolving threat. The continuous analysis and dissemination of such intelligence are vital for staying ahead of sophisticated threat actors.
The emergence of msaRAT underscores a broader trend in the cybercriminal underground: the increasing adoption of advanced programming languages like Rust and the creative exploitation of legitimate cloud services and protocols for malicious purposes. This evolution demands a commensurate evolution in defensive strategies, moving beyond traditional signature-based detection towards more behavioral analysis and anomaly detection.
The Chaos ransomware gang’s modus operandi, as revealed by the msaRAT backdoor, highlights the persistent threat posed by financially motivated cybercrime groups, often with complex operational infrastructures and evolving technical capabilities. The ability of these groups to adapt their tactics, techniques, and procedures (TTPs) to circumvent security measures necessitates a proactive and multi-layered approach to cybersecurity. This includes robust endpoint protection, advanced network monitoring, continuous security awareness training for employees, and the rapid integration of threat intelligence to identify and mitigate emerging threats. The ongoing cat-and-mouse game between attackers and defenders continues, with innovations like msaRAT pushing the boundaries of what is considered detectable. Organizations must remain vigilant and invest in comprehensive security solutions to safeguard their digital assets against these sophisticated adversaries.
