msaRAT: the backdoor that hides its C2 traffic inside Chrome and Edge

Researchers at Cisco Talos have described msaRAT, a new backdoor used by the Chaos ransomware group. Its key feature is that it never opens direct connections to the command server — instead, it hides all command-and-control traffic inside a legitimate browser, which sharply reduces the chances of detection.

How it works

The malware is written in Rust and relies on the Chrome DevTools Protocol (CDP). After locating Chrome or Microsoft Edge on the system, msaRAT launches the browser in headless mode — with no visible window — enables the remote debugging interface, and connects to it over CDP. It then opens a new tab and injects JavaScript into it.

It is this script that builds the communication channel: it bypasses the browser's Content Security Policy (CSP) and registers the CDP bindings it needs. Once everything is set up, the browser reaches out to a Cloudflare Workers endpoint, obtains the parameters for a WebRTC connection, and establishes an encrypted channel. The encryption is two-layered: DTLS, which the browser handles automatically, and a custom implementation of ChaCha20-Poly1305 with ECDH key exchange.

Betting on someone else's infrastructure

Traffic travels through Twilio's TURN servers, and the configuration deliberately omits the ICE candidates normally present in WebRTC. Without them, a direct connection between peers is impossible, so all traffic always passes through a relay. As a result, the attackers' real server IP address never appears in the network traffic.

Cloudflare Workers acts as a signaling relay: the destination address belongs to Cloudflare's infrastructure and sails through firewall checks and allowlists without trouble. On top of that, *.workers.dev subdomains are handed out to developers for free, so blocking them would hurt a great many legitimate services. The combination of Twilio and Cloudflare makes tracking the attackers' infrastructure extremely difficult.

The data exchange is broken into “frames,” which include key exchange, opening and closing channels, resetting the session, and executing Windows commands.

Who is behind the attacks

The Chaos group emerged in early 2025 and is not related to the identically named ransomware family known since 2021. Earlier this year, Rapid7 reported that the Chaos toolset had been used by the Iranian state-sponsored hackers MuddyWater, who disguised cyberespionage as financially motivated attacks.

According to Cisco Talos, the recent attacks began with phishing — either by email or by voice — and continued with the installation of legitimate remote-management software to establish persistence. An MSI installer posing as a Windows update was then downloaded to the system, and it loaded msaRAT (lib.dll) straight into memory.

A full list of indicators of compromise is provided in the Cisco Talos report.

Source: Bleeping Computer