type: entity · created: 2026-07-24 · updated: 2026-07-24 · tags: [malware, rat, c2, ransomware, rust, chrome-devtools-protocol, evasion] · confidence: high · affected_sectors: [technology] · au_impact: false
msaRAT — Chaos Ransomware C2 Implant
msaRAT is a Rust-based remote access trojan developed and deployed by the Chaos ransomware group, detailed by Cisco Talos in July 2026. It employs a novel C2 architecture that routes all traffic through the victim's own headless browser.
Technical Details
| Attribute | Detail |
|---|---|
| Language | Rust |
| Operator | Chaos ransomware group |
| Discovered by | Cisco Talos |
| C2 Method | Headless Chrome/Edge via Chrome DevTools Protocol |
| Transport | WebRTC data channels over Twilio TURN relay |
Novel C2 Architecture
msaRAT's key innovation is that it:
- Launches Chrome or Edge in headless mode on the compromised machine
- Drives the browser programmatically via the Chrome DevTools Protocol (CDP)
- Routes all C2 traffic through WebRTC data channels
- Relays traffic through Twilio's TURN service
The result is that the attacker's server address never appears on the wire. Defenders see only:
- Browser-originating traffic to Cloudflare (CDN)
- WebRTC/STUN/TURN traffic to Twilio infrastructure
Implications
- Defence evasion — Traditional network monitoring tools see normal browser traffic, not C2
- No static C2 infrastructure — The attacker's server is behind Cloudflare and Twilio
- Hard to block — Blocking Cloudflare or Twilio would impact legitimate services
- Cross-platform — Written in Rust, potentially portable beyond Windows
Related Pages
- Encforge — Encforge ransomware (another novel ransomware in the same period)
- Goddamn Ransomware — GodDamn ransomware with kernel driver EDR evasion (related evasion theme)
- Modbeacon Rat — MODBEACON Rust-based RAT with gRPC streaming C2 (different architecture, same language)