The Chaos ransomware gang is using a new Rust-based backdoor called msaRAT that hides command-and-control communication by routing traffic through Chrome or Edge browsers. The malware launches a headless browser session using Chrome DevTools Protocol, injects JavaScript, and establishes an encrypted channel through Cloudflare Workers and Twilio TURN servers. By intentionally omitting ICE candidates, the design prevents peer-to-peer connections, forcing all traffic through TURN and obscuring the attacker's true IP address.
The malware is delivered through an MSI installer posing as a Windows update after initial access through phishing and remote management tools. Communication features two encryption layers including WebRTC DTLS and ChaCha20-Poly1305 with ECDH key. Talos researchers noted the dual-layer infrastructure makes tracing the attacker extremely difficult, with the attacker's server IP never appearing in network traffic.
The Chaos ransomware group emerged in early 2025 and has been linked to Iranian state-backed hackers MuddyWater using the ransomware to disguise espionage operations. The malware avoids making direct connections to C2 infrastructure, significantly lowering detection risk. Cloudflare Workers endpoints provide signaling relay while maintaining the attacker's server behind legitimate infrastructure. The report provides extensive indicators of compromise for detecting msaRAT deployments. The communication mechanism controls C2 exchanges entirely within normal web traffic patterns.
Read more...