type: incident · created: 2026-07-24 · updated: 2026-07-24 · tags: [incident, ransomware, c2, evasion, msarat, chrome-devtools] · confidence: high · affected_sectors: [technology, finance, healthcare] · au_impact: true
Chaos Ransomware Uses Rust-Based msaRAT to Route C2 Through Headless Chrome
Cisco Talos researchers detailed a highly sophisticated command-and-control (C2) evasion technique deployed by the Chaos ransomware syndicate via a Rust-based implant called msaRAT. Instead of making outbound C2 connections, the malware launches headless instances of Chrome or Edge and drives them via the Chrome DevTools Protocol to route all communications over WebRTC channels via Twilio TURN service, making malicious traffic indistinguishable from normal browsing on the network.
| Attribute | Detail |
|---|---|
| Actor | Chaos ransomware syndicate |
| Implant | msaRAT (Rust-based) |
| Technique | Headless Chrome/Edge + Chrome DevTools Protocol → WebRTC over Twilio TURN |
| Effect | C2 traffic indistinguishable from normal browsing |
| Source | Cisco Talos (via The Hacker News) — Tier 2/4 |
This is a first-order detection-evasion technique: the malware hides C2 inside legitimate WebRTC/browser traffic, defeating network-layer signatures that look for non-browser outbound connections.
Related Pages
- Msarat — the Rust-based RAT/malware entity