Chaos Ransomware Group Deploys Sophisticated msaRAT Backdoor, Evading Detection via Browser-Based Command-and-Control

A new and highly evasive backdoor, dubbed msaRAT, has been identified in the arsenal of the Chaos ransomware gang, signaling a significant evolution in sophisticated command-and-control (C2) communication tactics. This innovative malware leverages common web browsers like Google Chrome and Microsoft Edge to route its C2 traffic, effectively burying malicious communications within legitimate network activity and drastically reducing the risk of detection by conventional security measures. The discovery, meticulously documented by the Cisco Talos research team, highlights a concerning trend towards the abuse of widely trusted internet protocols and services for malicious ends.

The msaRAT backdoor, written in the modern programming language Rust, utilizes the Chrome DevTools Protocol (CDP) to manipulate a headless browser session. By controlling a browser instance without a visible graphical user interface, the malware establishes an encrypted connection to the attacker’s server, making no direct connections to its C2 infrastructure. This method allows all communication to flow through the browser, camouflaged amidst the vast volume of everyday web traffic, posing substantial challenges for network-based detection systems.

The Evolving Threat of Chaos Ransomware

The Chaos ransomware group first emerged in early 2025, a distinct entity from an earlier ransomware family that bore the same name and had been active since 2021. The newer iteration quickly garnered attention from law enforcement and cybersecurity researchers alike. Early operations by this group led to significant disruptions, with the FBI famously seizing $2.4 million in Bitcoin from their illicit activities, underscoring the financial motivations behind their campaigns.

However, the narrative surrounding the Chaos ransomware group took a more complex turn earlier this year. Researchers at Rapid7 uncovered compelling evidence linking Chaos to Iranian state-backed hackers known as "MuddyWater" (also tracked as APT39, Seedworm, and Mercury). This revelation suggested a strategic pivot, where Chaos ransomware was not merely a tool for financial extortion but was actively leveraged by MuddyWater as a sophisticated decoy. By deploying financially motivated ransomware, the state-sponsored actors aimed to disguise their primary objectives, which were cyber-espionage and data exfiltration, making attribution and incident response significantly more challenging for targeted organizations. This blending of cybercrime and state-sponsored tactics exemplifies a growing trend where advanced persistent threat (APT) groups adopt common criminal tools for plausible deniability.

Cisco Talos’s recent observations shed light on the initial stages of these multifaceted attacks. Modern Chaos ransomware campaigns typically initiate through highly targeted email or voice phishing (vishing) operations. These social engineering tactics aim to trick victims into executing malicious payloads or divulging credentials. Once initial access is gained, attackers quickly move to establish persistence within the compromised environment, often through the installation of legitimate remote management software. This allows them to maintain access and control even if the initial entry vector is closed. Following this, the attackers download an MSI installer, cleverly disguised as a routine Windows update, which then stealthily loads msaRAT (specifically, ‘lib.dll’) directly into system memory, avoiding disk-based indicators of compromise as much as possible. This multi-stage infection chain highlights the meticulous planning and operational security employed by the threat actors.

msaRAT’s Technical Sophistication: Hijacking the Browser

The true innovation of msaRAT lies in its sophisticated C2 communication mechanism. Upon execution, the malware actively scans for installed web browsers, prioritizing Google Chrome or Microsoft Edge. It then launches the identified browser in "headless mode," a configuration where the browser process runs in the background without any visible graphical user interface. This makes it difficult for a user to detect its presence, as no browser window pops up.

The next critical step involves enabling the browser’s remote debugging interface and connecting to it via the Chrome DevTools Protocol (CDP). CDP is an powerful API designed for developers to inspect, debug, and profile web applications and browsers. While legitimate, msaRAT weaponizes this protocol. Once connected, the malware opens a new, invisible browser tab and injects carefully crafted JavaScript code into it using CDP commands. This injected JavaScript is the lynchpin for building the clandestine communication channel, allowing msaRAT to bypass the browser’s Content Security Policy (CSP), a security layer designed to prevent cross-site scripting (XSS) and other code injection attacks. Furthermore, the JavaScript registers several CDP bindings, enabling the seamless, covert exchange of data.

The Double-Layered Communication Fortress

Once the initial browser setup is complete, the seemingly innocuous browser tab initiates contact with a Cloudflare Workers endpoint (specifically, is-01-ast[.]ols-img-12[.]workers[.]dev). This endpoint serves as a signaling relay, crucial for obtaining WebRTC connection information and establishing an encrypted channel. WebRTC (Web Real-Time Communication) is an open-source project that provides web browsers and mobile applications with real-time communication (RTC) via simple application programming interfaces (APIs). It enables peer-to-peer communication, often used for video conferencing and live streaming.

Cisco Talos researchers meticulously dissected the communication scheme, revealing two distinct layers of encryption. The first layer is provided automatically by the WebRTC standard: Datagram Transport Layer Security (DTLS). DTLS is a communications protocol that provides security for datagram-based applications by allowing them to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. The second, custom layer of encryption is implemented directly by msaRAT, utilizing ChaCha20-Poly1305 for authenticated encryption and Elliptic Curve Diffie-Hellman (ECDH) for secure key exchange. This dual-layer encryption significantly enhances the confidentiality and integrity of the C2 traffic, making it exceedingly difficult for defenders to decrypt and understand the malicious communications even if intercepted.

Further adding to its stealth, msaRAT’s communication is relayed through Twilio TURN (Traversal Using Relays around NAT) servers. TURN servers are legitimate components of WebRTC infrastructure, designed to facilitate communication between peers that are behind restrictive firewalls or Network Address Translators (NATs) by relaying traffic. However, msaRAT employs a specific configuration that intentionally omits the ICE (Interactive Connectivity Establishment) candidates that are typically present in standard WebRTC communications. By doing so, direct peer-to-peer connections are actively prevented, forcing all communications to be routed exclusively through Twilio’s TURN relays.

This ingenious design has profound implications for attribution and detection. By routing traffic through Twilio’s legitimate service, the actual IP address of the attacker’s C2 server is never exposed in the network traffic. Coupled with the Cloudflare Workers endpoint, this creates a formidable, dual-layer infrastructure that makes tracing the attacker’s true infrastructure significantly challenging. Cloudflare Workers, a serverless computing platform, allows developers to deploy code that runs at the edge of Cloudflare’s network. When used as a signaling relay, the destination IP address appears to belong to Cloudflare’s vast infrastructure, easily passing firewall and allowlist automatic verifications. Moreover, the *.workers.dev free subdomain is assigned to developers for legitimate purposes, making broad blocking problematic as it would disrupt numerous benign services and applications.

The researchers also documented how msaRAT manages data exchange, breaking down messages into "frames." These frames encapsulate various critical functions, including key exchanges for the encrypted channels, commands for opening and closing communication channels, session resets, and crucially, commands for executing Windows operating system commands on the compromised machine. This granular control allows the attackers to maintain a persistent and versatile foothold within the victim’s network without ever directly touching the network interface in a suspicious manner.

Broader Implications for Cybersecurity

The emergence of msaRAT represents a new benchmark in C2 evasion and poses significant challenges for conventional cybersecurity defenses. The core innovation—masking C2 traffic within normal browser activity—undermines traditional network security tools like firewalls and intrusion detection/prevention systems (IDS/IPS) that rely on identifying anomalous network patterns or known malicious IP addresses. When legitimate services and protocols are abused in this manner, differentiating malicious traffic from benign user activity becomes a Herculean task.

For enterprise security teams, this means a shift in focus is imperative. While network-level monitoring remains important for detecting initial infection vectors, endpoint detection and response (EDR) and extended detection and response (XDR) solutions become even more critical. These tools are better positioned to identify the behavioral anomalies associated with msaRAT, such as:

• Unexpected launches of headless browser instances (Chrome or Edge).
• Unusual processes making connections via the Chrome DevTools Protocol.
• The execution of the initial MSI installer disguised as a Windows update.
• The loading of lib.dll directly into system memory without a corresponding legitimate process.
• Anomalous process trees originating from browser processes that are not typical user interactions.

Furthermore, the sophisticated use of legitimate cloud services like Cloudflare Workers and Twilio TURN servers highlights the need for organizations to scrutinize their network traffic not just for known malicious indicators, but for unusual patterns of communication with otherwise legitimate services. This requires advanced analytics, threat intelligence, and potentially AI/ML-driven detection capabilities to identify subtle deviations from baseline behavior.

The explicit connection of the Chaos ransomware group to Iranian state-backed actors like MuddyWater also underscores the increasing convergence of financially motivated cybercrime and nation-state espionage. This blurring of lines complicates attribution and response, as it provides APT groups with plausible deniability and allows them to achieve their strategic objectives under the guise of common criminal activity. Defenders must be prepared for adversaries who can seamlessly pivot between different objectives and leverage a broad spectrum of tools and tactics.

Expert Commentary and Recommendations

Security experts from Cisco Talos have provided a comprehensive list of Indicators of Compromise (IoCs) associated with msaRAT backdoor attacks, made available on their GitHub repository. This resource is vital for organizations seeking to proactively detect and block related malicious activity.

In light of msaRAT’s sophistication, cybersecurity professionals universally recommend a multi-layered defense strategy:

1. Enhanced User Awareness and Training: Continuous and rigorous training on phishing, vishing, and social engineering tactics is paramount, as the initial compromise often relies on human error.
2. Robust Endpoint Security: Deploying and maintaining advanced EDR/XDR solutions capable of behavioral analysis and memory forensics is crucial to detect the malware’s execution and its interaction with the browser.
3. Network Segmentation and Monitoring: While msaRAT evades traditional network detection, strong network segmentation can limit lateral movement, and advanced network traffic analysis (NTA) can still identify the initial stages of an attack or anomalous external connections.
4. Principle of Least Privilege: Implementing strict access controls and ensuring users and applications only have the necessary permissions can limit the impact of a successful breach.
5. Regular Patching and Vulnerability Management: Keeping operating systems, applications, and browsers updated is essential to mitigate known vulnerabilities that attackers might exploit.
6. Monitoring for Abnormal Browser Activity: Organizations should implement controls or monitoring solutions that can flag instances of headless browser launches, unexpected CDP connections, or unusual browser process behavior.
7. Zero-Trust Architectures: Adopting a zero-trust model, which assumes no user or device is inherently trustworthy, can help enforce stricter verification for every access attempt, regardless of location.

Browser vendors like Google and Microsoft may also need to evaluate the potential for abuse of protocols like CDP, potentially adding more granular controls, telemetry, or warnings for its use in enterprise environments. Similarly, legitimate service providers like Cloudflare and Twilio, while not responsible for the misuse of their platforms, continuously refine their abuse detection and mitigation strategies.

The msaRAT backdoor marks a significant leap in malware stealth, exploiting the trust placed in web browsers and cloud infrastructure. Its discovery underscores the relentless innovation of threat actors and serves as a stark reminder that cybersecurity defenses must continuously adapt, moving beyond signature-based detection to embrace behavioral analysis and a deep understanding of adversary tactics, techniques, and procedures (TTPs). The battle against sophisticated threats like msaRAT will require a collaborative effort from researchers, vendors, and security teams worldwide to protect against the next generation of evasive cyberattacks.