Loading malware…
msaRAT is a Rust-based remote access trojan attributed to the Chaos ransomware group and used in the period between initial compromise and ransomware deployment. It is designed to provide covert command-and-control by avoiding direct outbound communications from the malware process itself. Instead, it locates Google Chrome or Microsoft Edge on the victim system, launches a headless browser instance with remote debugging enabled, and controls it through the Chrome DevTools Protocol to inject JavaScript and establish a browser-mediated communications channel.
Its most distinctive feature is the use of WebRTC for command-and-control. The injected browser-side code obtains signaling and relay configuration from a Cloudflare Workers endpoint, creates an RTCPeerConnection and DataChannel, and forces traffic through TURN relay infrastructure rather than direct peer-to-peer connectivity. This causes external traffic to appear as legitimate browser activity and helps conceal attacker infrastructure behind widely used cloud and communications services. Communications are protected by WebRTC DTLS and an additional ChaCha-Poly1305 layer using an ECDH-derived key.
Observed deployment involved an MSI installer masquerading as a Windows update that loaded the malware directly into memory from an embedded DLL. The malware then searched for installed Chrome or Edge browsers, connected to the browser debugging interface over loopback, bypassed browser content security restrictions, and relayed browser events and data through registered DevTools bindings. Reported operator functionality included remote shell command execution with output returned over the same browser-mediated channel.
msaRAT is associated with the Chaos ransomware-as-a-service operation, a group known for double-extortion activity against large organizations. Chaos has been reported to obtain initial access through spam email and vishing, after which msaRAT is deployed as a stealthy post-compromise backdoor to support further intrusion activity before ransomware execution. The malware targets Windows systems and emphasizes defense evasion by blending malicious traffic into normal enterprise web traffic.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cisco Talos has discovered a new Rust-based remote access trojan (RAT) we call “msaRAT” attributed to the Chaos ransomware group.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The property information of this installer, which extracts the DLL file containing the RAT payload, contains details configured to impersonate a Windows update.
When this MSI file is executed, the custom action CA_Run_EA2AEBC3 is triggered upon completion of InstallFinalize. This custom action loads lib.dll, embedded in the MSI file's Binary table as Bin_lib_EA2AEBC3, directly into memory.
msaRAT never touches the network directly — it controls its C2 communication channel exclusively through Chrome DevTools Protocol (CDP), a browser debugging API.
Since the malware routes all communication through the browser, it does not make any direct connection to the C2 infrastructure, significantly lowering the risk of detection.
Communication is relayed through Twilio TURN (Traversal Using Relays around NAT) servers with a specific configuration to avoid direct peer-to-peer connections.
the attacker runs the following curl command to download an MSI file named “update_ms.msi” from an attacker-controlled server to the ProgramData directory on the victim machine, then executes it.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Rust-based remote access trojan used by the Chaos ransomware group. It hijacks Chrome or Edge via the Chrome DevTools Protocol, injects JavaScript into a headless browser, uses Cloudflare Workers for WebRTC signaling, Twilio TURN for relay, and establishes a covert double-encrypted C2 channel over a WebRTC DataChannel while avoiding direct network connections from the malware process itself.
A Rust-based remote access trojan used by the Chaos ransomware group. It hijacks Chrome or Edge via the Chrome DevTools Protocol, launches the browser in headless mode, injects JavaScript, and establishes covert C2 over a WebRTC DataChannel using Cloudflare Workers for signaling and Twilio TURN as relay infrastructure. It supports browser-leveraged remote code execution, covert tunneling, encrypted C2, and reliable transfer of larger payloads.
A Rust-written backdoor/RAT that hides C2 traffic by launching Chrome or Edge in headless mode, using the Chrome DevTools Protocol to inject JavaScript, and establishing encrypted communications via WebRTC relayed through Cloudflare Workers and Twilio TURN servers.
A Rust-based remote access trojan that launches its own Chrome or Edge instance on the victim machine, controls it via Chrome DevTools Protocol, and tunnels command-and-control over WebRTC. It executes shell commands through cmd.exe, returns output over the same encrypted channel, and hides external traffic behind legitimate browser processes using Cloudflare Workers, Google STUN, and Twilio TURN infrastructure.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.