Loading malware…
msaRAT is a Rust-based remote access trojan attributed to the Chaos ransomware group and used in post-compromise activity prior to ransomware deployment. It is designed to conceal command-and-control by delegating external network communications to a locally launched instance of Google Chrome or Microsoft Edge rather than having the malware process connect outward directly. On infected Windows systems, the malware searches for a supported browser, launches it in headless mode with remote debugging enabled, and controls it through the Chrome DevTools Protocol. It then injects JavaScript into a browser tab, bypasses content security policy restrictions, and establishes command-and-control over a WebRTC DataChannel.
For session establishment, msaRAT uses browser-mediated signaling through Cloudflare Workers and forces WebRTC traffic through TURN relay infrastructure, including Twilio services, instead of direct peer-to-peer connectivity. This architecture obscures attacker-controlled infrastructure and makes malicious traffic resemble legitimate browser activity. The malware further protects communications with layered encryption, combining WebRTC DTLS with an additional ChaCha-Poly1305 scheme using keys derived through ECDH.
Observed deployment involved a Windows installer masquerading as a software or system update that loaded the malware directly into memory, reducing file-based artifacts. The implant supports remote command execution through the compromised host and includes mechanisms consistent with reliable transfer of larger data over its browser-mediated channel. Its tradecraft aligns with Chaos operations that use the malware after initial access and before encryption, helping operators blend into enterprise traffic and complicate network-based detection.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos a publié le 23 juillet 2026 une analyse technique d’un nouveau RAT (Remote Access Trojan) nommé msaRAT, attribué au groupe Chaos... msaRAT se distingue par une architecture C2 entièrement déléguée au navigateur.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
The MSI impersonates a Windows update and loads the RAT DLL directly into memory via a custom installer action.
After gaining access to a Windows machine, the attacker runs curl to download an MSI file named update_ms.msi
What a network defender sees on the wire is a browser process making HTTPS requests to Cloudflare and WebRTC traffic to Twilio’s relay service, both legitimate, both commonly allowed.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Rust-based remote access trojan that uses the Chrome DevTools Protocol to manipulate the Chrome browser for command-and-control, avoiding direct network access by the malware binary itself. It performs SDP offer/answer signaling with an embedded Cloudflare Workers endpoint, establishes a WebRTC DataChannel to the C2 server, and uses Twilio TURN for NAT traversal and covert tunneling.
Rust-based remote access trojan that hides C2 by proxying all communications through the victim's Chrome or Edge browser via Chrome DevTools Protocol, then using WebRTC DataChannel relayed through Cloudflare Workers for signaling and Twilio TURN infrastructure for traffic relay. It is used post-initial-access for reconnaissance before ransomware deployment and avoids direct network connections from the malware process itself.
Rust-based remote access tool used by Chaos ransomware operators. It hides command-and-control and data movement inside headless Chrome or Microsoft Edge sessions by using Chrome DevTools Protocol, JavaScript injection, Cloudflare Workers for signaling, and WebRTC/TURN relays, with additional encryption to conceal attacker communications.
A Rust-based post-compromise implant used ahead of ransomware deployment. It launches Chrome or Edge in headless mode, abuses the Chrome DevTools Protocol to inject JavaScript, and tunnels C2 over WebRTC data channels relayed via Twilio TURN so network traffic appears to originate from a legitimate browser. It executes commands via cmd.exe and appears designed to reliably move larger payloads such as screenshots or files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.