Don’t swing at everything

What Happened

Cisco's security researchers found a new type of hacking tool called msaRAT that criminal group Chaos uses to secretly control infected Windows computers by hijacking the victim's own web browser (Chrome or Edge), making the malicious traffic look like normal browsing instead of an obvious attack. It arrives disguised as a fake Windows update file and can lead to ransomware that locks up files and demands payment. This matters to any organization using Windows and standard browsers, since the technique is designed to slip past normal network security tools. The newsletter also notes that new security vulnerabilities are being discovered faster than organizations can patch them, and recommends prioritizing fixes based on real-world exploitation likelihood rather than trying to patch everything at once. Defenders should watch for suspicious file downloads disguised as Windows updates and unusual browser behavior, and generally patch based on actual exploitation risk rather than severity scores alone.

Key Takeaways

• Cisco Talos discovered msaRAT, a new Rust-based RAT deployed by the Chaos ransomware group that abuses the Chrome DevTools Protocol (CDP) to hijack Chrome/Edge browsers for covert C2, avoiding direct network-based detections.
• msaRAT is delivered via a malicious MSI file masquerading as a Windows update, loading the payload directly into memory before deploying ransomware.
• 2026 Q2 CVE growth is up 49% YoY, tracking near 200 CVEs/day, while CISA KEV growth is comparatively flat at 13% YoY.
• 46% of actively-exploited (KEV) CVEs as of mid-2026 trace back to 2025 or earlier, underscoring that patch backlogs, not just new disclosures, remain a major exposure driver.
• The article recommends using EPSS alongside CVSS to prioritize patching, noting that of ~3,700 CVSS 9+ CVEs, only 32 have EPSS ≥ 50%, and 25 of those are already KEV-listed.

Affected Systems

• Windows systems (Chaos ransomware/msaRAT targets)
• Chrome and Edge browsers (abused via CDP for C2)
• WordPress sites (CVE-2026-60137 / CVE-2026-63030 chain)
• Progress ShareFile Storage Zone Controller (self-hosted server component)
• Microsoft SharePoint (deserialization flaw exploitation)

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Victim is delivered a malicious MSI file disguised as a legitimate Windows update.
2. Execution: The MSI loads the msaRAT payload directly into memory, avoiding disk-based artifacts.
3. Command and Control: msaRAT hijacks Chrome or Edge via the Chrome DevTools Protocol to establish a covert C2 channel that blends with legitimate browser traffic.
4. Evasion: Traffic is routed through trusted browser processes and services, bypassing traditional network-based detection.
5. Impact: The attacker leverages persistent access to deploy Chaos ransomware in a double-extortion scheme.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Cisco Talos full blog post (linked, not reproduced)

The newsletter references a separate full Talos blog post covering msaRAT with complete indicators of compromise; detection rule content was not reproduced here and readers are directed to the linked full report for IOCs and coverage details.

Detection Engineering Assessment

Required Log Sources

• Process creation logs (e.g., Windows Event ID 4688 / Sysmon Event ID 1)
• Command-line logging for msiexec.exe and curl
• Network connection logs / proxy logs showing browser process network activity
• Browser debugging port / DevTools Protocol usage logs if available

Hunting Hypotheses

Control Gaps

• Traditional network-based IP/domain reputation blocking will likely miss C2 traffic routed through trusted browser processes.
• Signature-based antivirus may not detect an in-memory-loaded Rust/Tokio payload delivered via a disguised MSI.
• Standard TLS/HTTPS inspection may not flag plain HTTP traffic sent over port 443 without protocol-aware inspection.

Key Behavioral Indicators

• MSI installer processes with file names or metadata mimicking Windows Update but lacking valid Microsoft signatures
• Browser processes (chrome.exe, msedge.exe) spawning with unusual command-line flags related to remote debugging or DevTools
• curl processes downloading MSI files into ProgramData or non-standard directories
• Mismatched protocol usage on port 443 (plain HTTP instead of TLS)

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate whether browser remote debugging ports (used by the Chrome DevTools Protocol) can be disabled or restricted via group policy in your environment.
• Consider implementing protocol-aware network inspection to detect plain HTTP traffic disguised as HTTPS on port 443.
• Where applicable, prioritize patching using EPSS scores alongside CVSS to focus remediation on CVEs with higher real-world exploitation probability, as discussed in this newsletter.

User Protection

• Consider deploying application allowlisting or code-signing enforcement to prevent execution of unsigned MSI files masquerading as Windows updates.
• If supported, enable behavioral monitoring on endpoints to flag anomalous browser process behavior indicative of DevTools Protocol abuse.

Security Awareness

• Consider incorporating awareness training on recognizing fake software update prompts and unsolicited installer files.
• Evaluate whether your organization's patch management program incorporates exploitability scoring (e.g., EPSS) rather than relying solely on CVSS severity.

MITRE ATT&CK Mapping

Additional IOCs

• Urls:
  • hxxps://talosintelligence[.]com/talos_file_reputation?s=9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 - Talos file reputation lookup for a prevalent malware sample (Coinminer worm variant) from weekly telemetry.
  • hxxps://talosintelligence[.]com/talos_file_reputation?s=9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f - Talos file reputation lookup for a prevalent tool (Procpatcher) from weekly telemetry.
  • hxxps://talosintelligence[.]com/talos_file_reputation?s=e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba - Talos file reputation lookup for a prevalent malware sample flagged as MalwareXgenMisc variant.
  • hxxps://talosintelligence[.]com/talos_file_reputation?s=633bd79d1efd3730234d907a2a0d98e3e253a5f0e222e4e4bf3badb3fd6aea0a - Talos file reputation lookup for a prevalent trojan sample (server_tcp.exe).
  • hxxps://talosintelligence[.]com/talos_file_reputation?s=90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 - Talos file reputation lookup for a prevalent generically-detected sample (tmp00055df5.dll).
• File Hashes:
  • 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 (SHA256) - Prevalent malware sample from Talos telemetry, example filename VID001.exe, detected as Win.Worm.Coinminer.
  • 2915b3f8b703eb744fc54c81f4a9c67f (MD5) - MD5 for prevalent malware sample VID001.exe (Win.Worm.Coinminer).
  • 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f (SHA256) - Prevalent tool sample from Talos telemetry, example filename SECOH-QAD.exe, detected as Win.Tool.Procpatcher.
  • 38de5b216c33833af710e88f7f64fc98 (MD5) - MD5 for prevalent sample SECOH-QAD.exe (Win.Tool.Procpatcher).
  • e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba (SHA256) - Prevalent malware sample from Talos telemetry, example filename u165714.dat, detected as W32.Variant:MalwareXgenMisc.
  • dbd8dbecaa80795c135137d69921fdba (MD5) - MD5 for prevalent sample u165714.dat (MalwareXgenMisc variant).
  • 633bd79d1efd3730234d907a2a0d98e3e253a5f0e222e4e4bf3badb3fd6aea0a (SHA256) - Prevalent trojan sample from Talos telemetry, example filename server_tcp.exe, detected as W32.Trojan.27oc.
  • 770dbe473180366d7b539ff2c188e551 (MD5) - MD5 for prevalent sample server_tcp.exe (W32.Trojan.27oc).
  • 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 (SHA256) - Prevalent sample from Talos telemetry, example filename tmp00055df5.dll, detected via generic Auto detection.
  • c2efb2dcacba6d3ccc175b6ce1b7ed0a (MD5) - MD5 for prevalent sample tmp00055df5.dll (generic Auto detection).
• Command Lines:
  • Purpose: Downloading a malicious MSI file disguised as a Windows update into a staging directory, potentially over deceptive HTTP-over-443 traffic | Tools: curl | Stage: Delivery/Initial Access | curl <url> -o C:\ProgramData\<file>.msi