Loading malware…
msaRAT is a Rust-based remote access trojan attributed to the Chaos ransomware group and observed in post-compromise activity prior to ransomware deployment. It is notable for delegating its external command-and-control communications to the victim’s own Chrome or Microsoft Edge browser rather than opening direct outbound connections from the malware process. The implant launches a headless browser with remote debugging enabled, connects to it over the Chrome DevTools Protocol, bypasses content security restrictions, and injects JavaScript that establishes a covert WebRTC DataChannel for command-and-control. Signaling is performed through a Cloudflare Workers endpoint, while relay traffic is forced through Twilio TURN infrastructure by omitting direct ICE candidates, helping conceal attacker infrastructure and making malicious traffic appear as ordinary browser activity. msaRAT applies layered encryption by combining browser-provided DTLS with an additional ChaCha-Poly1305 scheme using an ECDH-derived key. It supports remote command execution on compromised Windows systems and includes flow-control logic consistent with transferring larger payloads such as screenshots or files. Delivery observed in Chaos intrusions involved a fake software-update MSI that loaded the Rust payload directly into memory. Chaos operators have been associated with spam and voice-phishing initial access patterns, but msaRAT itself has been documented as a post-access implant used to maintain covert interactive control.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
On 23 July 2026, one day before TWINLOOT was compiled, Cisco Talos published their analysis of Chaos group’s msaRAT, which uses the same class of technique (headless browser + TURN relay) but routes through Twilio rather than Teams.
Then, late last month, another new Rust-based RAT dubbed msaRAT was observed using the same TURN method, but against Twilio instead of Teams.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
For initial access, they rely on spam emails and voice-based social engineering, commonly known as vishing.
By using Cloudflare Workers as the signaling relay, the attacker ensures that their server remains protected as the destination IP address is assigned to Cloudflare's infrastructure.
Its operators commonly gain entry through spam emails and voice phishing, then use remote-management tools and legitimate file-sharing services to keep access and steal data.
The initial compromise occurred via social engineering on Microsoft Teams. An external actor impersonating IT support convinced a user to run a PowerShell command that downloaded an archive containing a staged Python 3.12.9 embeddable runtime and a 39 MB compiled payload.
Its operators commonly gain entry through spam emails and voice phishing, then use remote-management tools and legitimate file-sharing services to keep access and steal data.
T1059 — Command and Scripting Interpreter (Execution)
The implant passes incoming command frames to cmd.exe /e:ON /v:OFF /d /c <cmd> for execution.
Once it finds a browser, msaRAT launches it in headless mode with remote debugging enabled, connects to it over the local debugging port, bypasses Content Security Policy using a CDP command, and injects JavaScript that handles all the actual network work.
The MSI impersonates a Windows update and loads the RAT DLL directly into memory via a custom installer action.
l’implant lance le navigateur Edge de la victime en mode headless ... Le trafic C2 apparaît comme msedge.exe communiquant avec Microsoft
As the first step toward that goal, it searches for the installation path of Chrome or Edge on the victim machine.
The MSI impersonates a Windows update and loads the RAT DLL directly into memory via a custom installer action.
If no path is found through environment variables, the malware falls back to searching for Chrome exclusively via the registry.
As the first step toward that goal, it searches for the installation path of Chrome or Edge on the victim machine.
The group’s msaRAT remote-access tool turns Chrome or Microsoft Edge into a covert channel for receiving commands and moving data.
T1071 — Application Layer Protocol (Command and Control)
What a network defender sees on the wire is a browser process making HTTPS requests to Cloudflare and WebRTC traffic to Twilio’s relay service, both legitimate, both commonly allowed.
T1090 — Proxy (Command and Control)
ou via les relais TURN de Microsoft Teams ... en utilisant des WebRTC DataChannels
After gaining access to a Windows machine, the attacker runs curl to download an MSI file named update_ms.msi from an attacker-controlled server on port 443, though the traffic runs over plain HTTP.
T1219 — Remote Access Software (Command and Control)
T1572 — Protocol Tunneling (Command and Control)
The communication is double-encrypted. WebRTC DataChannel is already protected by DTLS, which the browser handles automatically. On top of that, msaRAT encrypts the payload itself using ChaCha-Poly1305 with a key derived through an ECDH handshake at connection time.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.