Chaos Ransomware Gang Uses msaRAT to Route C2 Traffic Through Chrome and Edge
Summary
Cisco Talos says the Chaos group uses Rust-based msaRAT to control headless Chrome or Edge and relay encrypted C2 traffic through Cloudflare Workers and Twilio TURN, obscuring attacker infrastructure.
Key points
- Cisco Talos reports that the Chaos ransomware group uses msaRAT, a Rust-based backdoor.
- The malware launches Chrome or Edge in headless mode and uses the Chrome DevTools Protocol to inject JavaScript and establish a communication channel.
- A Cloudflare Workers endpoint, is-01-ast[.]ols-img-12[.]workers[.]dev, provides WebRTC connection information.
- Communications are relayed through Twilio TURN servers; the described configuration prevents direct peer-to-peer connections.
- The channel uses WebRTC DTLS alongside msaRAT-implemented ChaCha20-Poly1305 and ECDH encryption, according to the report.
- Talos says recent attacks began with email or voice phishing and involved remote management software; an MSI posing as a Windows update loaded msaRAT into memory.
- The relays obscure the attacker's server IP, while blocking the workers.dev domain broadly could also affect legitimate Cloudflare Workers services.
Article Details
- Attack Vectors
- Email or voice phishing initiated the reported attacks.
- Remote management software was installed to establish persistence.
- An MSI installer posing as a Windows update loaded msaRAT directly into system memory.
- msaRAT controlled Chrome or Edge in headless mode via Chrome DevTools Protocol, injecting JavaScript to establish a covert communication channel.
- C2 communications were relayed through a Cloudflare Workers endpoint and Twilio TURN servers rather than connecting directly to attacker infrastructure.
- Defensive Notes
- The article cautions that blocking the broad workers.dev subdomain could disrupt legitimate Cloudflare Workers deployments and benign services.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | is-01-ast[.]ols-img-12[.]workers[.]dev | Cloudflare Workers endpoint used by msaRAT to obtain WebRTC connection information and establish its relayed communication channel. |
MITRE ATT&CK
T1036 · MasqueradingThe MSI installer loading msaRAT was disguised as a Windows update.T1059.007 · JavaScriptmsaRAT injects JavaScript into a browser tab using Chrome DevTools Protocol to build its communication channel.T1090.003 · Multi-hop ProxyC2 communications are relayed through Cloudflare Workers and Twilio TURN, preventing direct connections to the attacker’s server.T1105 · Ingress Tool TransferThe attacker downloaded an MSI installer that loaded msaRAT.T1219 · Remote Access ToolsRemote management software was installed during the reported attacks to establish persistence.T1518 · Software DiscoverymsaRAT searches for Chrome or Microsoft Edge before launching a headless browser.T1566 · PhishingThe reported Chaos attacks began through email or voice phishing.T1573.001 · Symmetric CryptographymsaRAT implements ChaCha20-Poly1305 encryption for its communications.T1573.002 · Asymmetric CryptographyThe article reports that msaRAT uses an ECDH key as part of its encryption setup.
Threat Actors
chaosThe article reports that the Chaos ransomware gang used msaRAT in attacks. It distinguishes this group from a same-named ransomware family that existed since 2021.MuddyWaterRapid7 researchers reportedly found that MuddyWater leveraged Chaos to disguise cyber-espionage operations as financially motivated attacks.
Malware
Vendors
CloudflareBy relaying communications through Cloudflare Workers and Twilio TURN, the malware avoids direct connections to attacker infrastructure and makes detection much harder.MicrosoftOnce launched, msaRAT searches for Chrome or Microsoft Edge and launches the browser in headless mode, where the process starts without any visible window.TwilioBy relaying communications through Cloudflare Workers and Twilio TURN, the malware avoids direct connections to attacker infrastructure and makes detection much harder.
Products
Cloudflare WorkersBy relaying communications through Cloudflare Workers and Twilio TURN, the malware avoids direct connections to attacker infrastructure and makes detection much harder.EdgeCisco Talos reports that the Chaos ransomware gang is using msaRAT, a Rust-based backdoor that hides command-and-control traffic by routing it through Chrome or Edge via the Chrome DevTools Protocol.Google ChromeCisco Talos reports that the Chaos ransomware gang is using msaRAT, a Rust-based backdoor that hides command-and-control traffic by routing it through Chrome or Edge via the Chrome DevTools Protocol.Twilio TURNBy relaying communications through Cloudflare Workers and Twilio TURN, the malware avoids direct connections to attacker infrastructure and makes detection much harder.