type: entity · created: 2026-07-24 · updated: 2026-07-24 · tags: [malware, rat, c2, ransomware, rust, chrome-devtools-protocol, evasion] · confidence: high · affected_sectors: [technology] · au_impact: false
🎯 IOCs · Chaos
Indicators of compromise · Chaos — 4 shown
8cd11b6e3504363d2818cfa541698af18f80be3552e038dfa9369c0ba28c6817a1cdb7f8862d5ff9abd16757a60f4e1bbaa18a650de89904c94aa351174e405b4a94ce0d72ff3442ca640c28d4c5f7abd3c40fd36abebfaf9f5cdbee6ceae24e782815d50e36c4568378c81db487a01acef0fae9b9685881c03e60c2b39f2baa
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
msaRAT — Chaos Ransomware C2 Implant
msaRAT is a Rust-based remote access trojan developed and deployed by the Chaos ransomware group, detailed by Cisco Talos in July 2026. It employs a novel C2 architecture that routes all traffic through the victim's own headless browser.
Technical Details
| Attribute | Detail |
|---|---|
| Language | Rust |
| Operator | Chaos ransomware group |
| Discovered by | Cisco Talos |
| C2 Method | Headless Chrome/Edge via Chrome DevTools Protocol |
| Transport | WebRTC data channels over Twilio TURN relay |
Novel C2 Architecture
msaRAT's key innovation is that it:
- Launches Chrome or Edge in headless mode on the compromised machine
- Drives the browser programmatically via the Chrome DevTools Protocol (CDP)
- Routes all C2 traffic through WebRTC data channels
- Relays traffic through Twilio's TURN service
The result is that the attacker's server address never appears on the wire. Defenders see only:
- Browser-originating traffic to Cloudflare (CDN)
- WebRTC/STUN/TURN traffic to Twilio infrastructure
Implications
- Defence evasion — Traditional network monitoring tools see normal browser traffic, not C2
- No static C2 infrastructure — The attacker's server is behind Cloudflare and Twilio
- Hard to block — Blocking Cloudflare or Twilio would impact legitimate services
- Cross-platform — Written in Rust, potentially portable beyond Windows
Related Pages
- Encforge — Encforge ransomware (another novel ransomware in the same period)
- Goddamn Ransomware — GodDamn ransomware with kernel driver EDR evasion (related evasion theme)
- Modbeacon Rat — MODBEACON Rust-based RAT with gRPC streaming C2 (different architecture, same language)