Talos Details msaRAT, a Chaos-Attributed RAT That Hides C2 in Browser Traffic
Summary
Cisco Talos describes msaRAT, a Rust RAT attributed to Chaos, which uses Chrome or Edge via CDP to establish WebRTC C2 through Cloudflare Workers signaling and Twilio TURN relaying, with ChaCha-Poly1305 encryption layered over DTLS.
Key points
- Talos says attackers deliver an MSI over plain HTTP on port 443; the installer loads the RAT’s DLL directly into memory.
- msaRAT searches for Chrome or Edge, launches the browser headlessly, and uses Chrome DevTools Protocol to inject JavaScript and handle C2 communications.
- The browser uses Cloudflare Workers at is-01-ast[.]ols-img-12[.]workers[.]dev for WebRTC signaling; Twilio TURN relays the resulting DataChannel traffic.
- Talos reports that the C2’s SDP answer omits ICE candidates, preventing direct peer-to-peer connections and routing communications through TURN.
- The WebRTC connection uses DTLS, while msaRAT separately encrypts data with a ChaCha-Poly1305-based scheme using a key derived through ECDH.
- Talos lists a ClamAV signature and Snort 2 and Snort 3 rules for detection and blocking.
Article Details
- Attack Vectors
- After gaining access to a victim machine, the attacker downloads update_ms.msi with curl.exe from an attacker-controlled server over plain HTTP on port 443, then executes it.
- The MSI installer triggers a custom action that loads the embedded lib.dll payload into memory.
- msaRAT launches Chrome or Edge in headless mode, enables Chrome DevTools Protocol, bypasses Content Security Policy, and injects JavaScript into the browser.
- The malware uses a Cloudflare Workers endpoint for WebRTC signaling and Twilio TURN to relay its C2 DataChannel traffic.
- Defensive Notes
- Inspect traffic protocol as well as port: the MSI download uses plain HTTP on port 443.
- Cisco Talos reports that ClamAV signature Win.Downloader.ChaosRaas-10060321-0 detects and blocks the threat.
- Cisco Talos reports these Snort detection SIDs: Snort 2: 1:66840, 1:66841, 1:66839; Snort 3: 1:301587, 1:66839.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | is-01-ast[.]ols-img-12[.]workers[.]dev | Malware-used Cloudflare Workers endpoint for WebRTC signaling and retrieval of STUN/TURN configuration. |
| URL | hxxp[:]//172[.]86[.]126[.]18:443/update_ms.msi | Attacker-controlled download URL used to deliver the MSI containing the msaRAT payload. |
MITRE ATT&CK
T1012 · Query RegistryIf browser paths are not found through environment variables, msaRAT searches the registry for Chrome.T1036 · MasqueradingThe MSI installer’s property information is configured to impersonate a Windows update.T1059.007 · JavaScriptmsaRAT uses CDP Runtime.evaluate to inject and execute JavaScript in the browser.T1083 · File and Directory DiscoverymsaRAT checks candidate installation paths to locate Chrome or Edge on the victim machine.T1105 · Ingress Tool TransferThe attacker uses curl.exe to download update_ms.msi from an attacker-controlled server to the victim machine.T1218.007 · MsiexecThe MSI installer runs a custom action at InstallFinalize that loads the embedded lib.dll payload.T1572 · Protocol TunnelingThe malware uses a browser-controlled WebRTC DataChannel and a TURN relay to tunnel C2 communications.T1573.001 · Symmetric CryptographymsaRAT encrypts data sent through the C2 channel with ChaCha-Poly1305 in addition to WebRTC DTLS.T1573.002 · Asymmetric CryptographyThe malware performs an ECDH key exchange with the C2 server to derive the key used for its additional encryption layer.
Threat Actors
Malware
Vendors
CloudflareThe malware uses Cloudflare Workers for signaling and Twilio TURN for relayed communications, making its network activity difficult to trace and blending it into normal browser traffic.TwilioThe malware uses Cloudflare Workers for signaling and Twilio TURN for relayed communications, making its network activity difficult to trace and blending it into normal browser traffic.
Products
Cloudflare WorkersThe malware uses Cloudflare Workers for signaling and Twilio TURN for relayed communications, making its network activity difficult to trace and blending it into normal browser traffic.EdgeLocating the Chrome or Edge installation pathGoogle Chromeaccess trojan used by the Chaos ransomware group, which hides its command-and-control traffic by abusing Chrome DevTools Protocol and WebRTC through a browser process.Microsoft WindowsThe property information of this installer, which extracts the DLL file containing the RAT payload, contains details configured to impersonate a Windows update.