This Talos newsletter highlights the discovery of msaRAT, a Rust/Tokio-based remote access trojan used by the Chaos ransomware group that establishes covert command-and-control by hijacking Chrome/Edge browsers via the Chrome DevTools Protocol, delivered through an MSI disguised as a Windows update and loaded directly into memory. The issue also reviews Q2 2026 vulnerability landscape statistics, showing 49% YoY growth in total CVEs versus only 13% growth in CISA KEVs, and advocates using EPSS scoring alongside CVSS to prioritize patching against a backlog where nearly half of actively exploited CVEs date to 2025 or earlier.
Chaos ransomware
2 posts
Don’t swing at everything Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel Cisco Talos has identified msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware group, which establishes a covert C2 channel by hijacking the victim's browser via Chrome DevTools Protocol (CDP). The RAT launches Chrome or Edge in headless mode, injects JavaScript to create a WebRTC DataChannel using Cloudflare Workers for signaling and Twilio TURN as a relay, ensuring all network traffic originates from the browser process and blends with legitimate web traffic. The malware employs double-layer encryption (DTLS plus ChaCha-Poly1305 with ECDH key exchange) and routes all C2 through legitimate cloud infrastructure, making detection and tracing exceptionally difficult.