New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.

The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker’s server.

Since the malware routes all communication through the browser, it does not make any direct connection to the C2 infrastructure, significantly lowering the risk of detection.

The Chaos ransomware group emerged in early 2025, unrelated to the same-named ransomware family that existed since 2021.

Earlier this year, researchers at Rapid7 found that Chaos was leveraged by Iranian state-backed hackers ‘MuddyWater’ to disguise their cyber-espionage operations as financially motivated attacks.

More recent Chaos ransomware attacks observed by the Cisco Talos research team started through email or voice phishing and continued with the installation of remote management software to establish persistence.

Once inside the environment, the attacker downloaded an MSI installer posing as a Windows update, which loads msaRAT (lib.dll) directly in system memory.

Hijacking Chrome

Once launched, msaRAT searches for Chrome or Microsoft Edge and launches the browser in headless mode, where the process starts without any visible window.

Next, it enables the browser’s remote debugging interface and connects to it via CDP. After this step, it opens a new browser tab and injects JavaScript into it using CDP commands.

The injected JavaScript is responsible for building the communication channel, bypassing Chrome’s Content Security Policy (CSP), and registering several CDP bindings that enable communications.

Once the initial setup is complete, the browser contacts a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to obtain WebRTC connection information and establish an encrypted channel.

Talos explains that there are two layers of encryption: the WebRTC DTLS, automatically provided by the browser, and ChaCha20-Poly1305 + ECDH key, implemented by msaRAT.

Communication is relayed through Twilio TURN (Traversal Using Relays around NAT) servers with a specific configuration to avoid direct peer-to-peer connections.

“By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN,” explains Cisco.

“By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Cisco Confidential Workers makes it significantly difficult to trace the attacker’s infrastructure.”

The researchers documented how the data exchange system works by breaking down messages into chunks called “frames,” which include key exchanges, channel opening/closing, session resets, and Windows command execution.

By using Cloudflare Workers as the signaling relay, the attacker ensures that their server remains protected as the destination IP address is assigned to Cloudflare’s infrastructure and will pass firewall and allowlist automatic verification.

Also, the “*workers.dev” free subdomain is assigned for developers and blocking it would disrupt legitimate Cloudflare Workers deployments, and affect benign services.

The researchers underline that the communication mechanism in msaRAT allows it to control the C2 exchanges without touching the network directly and bury it within normal web traffic.

The report from Cisco Talos shares a complete list of indicators of compromise (IoCs) associated with attacks using the msaRAT backdoor attacks.