AI Security AI安全 7h ago Updated 2h ago 更新于 2小时前 46

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge 混沌勒索软件利用msaRAT通过无头Chrome和Edge路由C2流量

Chaos ransomware group utilizes msaRAT, a Rust-based implant that routes Command-and-Control (C2) traffic through headless Chrome or Edge browsers via the Chrome DevTools Protocol (CDP). The malware avoids direct outbound connections by leveraging WebRTC data channels relayed through Twilio’s TURN service, masking attacker infrastructure behind legitimate Cloudflare and Twilio traffic. msaRAT injects JavaScript into the browser to bypass Content Security Policy and establish encrypted tunnels us Chaos勒索软件组织使用名为msaRAT的Rust植入程序,通过控制受害者本地的无头Chrome或Edge浏览器建立命令与控制(C2)通道。 该恶意软件利用Chrome DevTools Protocol (CDP)驱动浏览器,并通过WebRTC数据通道及Twilio TURN服务中继流量,使通信伪装成正常的浏览器行为。 msaRAT采用双重加密机制(DTLS结合ChaCha-Poly1305),且不依赖浏览器漏洞,而是通过伪造Windows更新MSI文件进行投递和内存加载。 检测重点在于监控非交互式父进程启动带有`--headless=new`和`--remote-debugging-po

65
Hot 热度
70
Quality 质量
60
Impact 影响力

Analysis 深度分析

TL;DR

  • Chaos ransomware group utilizes msaRAT, a Rust-based implant that routes Command-and-Control (C2) traffic through headless Chrome or Edge browsers via the Chrome DevTools Protocol (CDP).
  • The malware avoids direct outbound connections by leveraging WebRTC data channels relayed through Twilio’s TURN service, masking attacker infrastructure behind legitimate Cloudflare and Twilio traffic.
  • msaRAT injects JavaScript into the browser to bypass Content Security Policy and establish encrypted tunnels using DTLS and ChaCha-Poly1305, executing commands via cmd.exe.
  • Detection relies on behavioral analysis rather than file hashes, specifically looking for non-interactive processes launching browsers with --headless=new and --remote-debugging-port flags.
  • The technique exploits firewall rules that allow port 443 traffic without deep packet inspection, allowing the initial MSI payload to download the DLL undetected.

Why It Matters

This tradecraft represents a significant evolution in evasion techniques by blending legitimate browser automation features with malicious C2 infrastructure, making it difficult for traditional network security tools to distinguish between benign web traffic and malware communication. For AI practitioners and security researchers, it highlights the critical importance of behavioral telemetry and process lineage monitoring over static signature-based detection, especially as attackers increasingly abuse cloud services like Cloudflare Workers and Twilio for infrastructure hiding.

Technical Details

  • Implant Architecture: msaRAT is written in Rust using the Tokio async runtime. It is delivered via an MSI installer disguised as a Windows update, which loads an embedded DLL into memory upon installation.
  • Browser Hijacking: The malware searches for Chrome or Edge via environment variables or registry keys, then launches them in headless mode (--headless=new) with remote debugging enabled (--remote-debugging-port). It uses a separate user-data directory to avoid detection by recent Chrome security changes regarding default profiles.
  • Communication Channel: CDP is used to inject JavaScript that fetches STUN/TURN configurations from a Cloudflare Worker. The malware establishes a WebRTC peer connection, forcing all traffic through Twilio’s global TURN server (global.turn.twilio.com) by returning an SDP answer with no ICE candidates and a 0.0.0.0 address.
  • Encryption and Execution: Traffic is double-encrypted: DTLS handled by the browser and an inner layer using ChaCha-Poly1305 keyed by an ECDH exchange initiated with a 0xFE handshake frame. Incoming commands are executed via cmd.exe /e:ON /v:OFF /d /c <cmd>.
  • Detection Signals: Key indicators include Runtime.addBinding and Runtime.evaluate calls via CDP, loopback traffic to debugging ports, and outbound WebRTC traffic from browser processes spawned by non-interactive parents (installers, services).

Industry Insight

  • Shift to Behavioral Detection: Organizations must move beyond port-based firewall rules and implement deep packet inspection or behavioral analytics to detect WebRTC and CDP anomalies, as attackers are effectively using legitimate protocols to tunnel malicious traffic.
  • Cloud Infrastructure Abuse: The reliance on Cloudflare Workers and Twilio TURN services demonstrates how attackers leverage trusted, high-bandwidth cloud infrastructure to obscure their C2 servers. Security teams should monitor for unusual WebRTC signaling patterns originating from internal endpoints, even if the external destinations are reputable services.
  • Endpoint Hardening: Since this is a post-compromise tool that does not exploit browser vulnerabilities, patching browsers alone is insufficient. Defense strategies should focus on restricting the execution of headless browser instances with debugging ports enabled, particularly when launched by non-browser processes, and enforcing strict application control policies on MSI installers.

TL;DR

  • Chaos勒索软件组织使用名为msaRAT的Rust植入程序,通过控制受害者本地的无头Chrome或Edge浏览器建立命令与控制(C2)通道。
  • 该恶意软件利用Chrome DevTools Protocol (CDP)驱动浏览器,并通过WebRTC数据通道及Twilio TURN服务中继流量,使通信伪装成正常的浏览器行为。
  • msaRAT采用双重加密机制(DTLS结合ChaCha-Poly1305),且不依赖浏览器漏洞,而是通过伪造Windows更新MSI文件进行投递和内存加载。
  • 检测重点在于监控非交互式父进程启动带有--headless=new--remote-debugging-port参数的浏览器,以及关联回环调试流量与出站WebRTC连接。

为什么值得看

这篇文章揭示了高级持续性威胁(APT)和勒索软件团伙如何利用合法系统工具(如浏览器和WebRTC基础设施)进行隐蔽通信,突破了传统基于端口和协议特征的网络防御。对于安全从业者而言,它强调了从基于签名的检测转向基于行为分析(如进程树异常和API调用模式)的重要性,特别是在零信任架构下识别“合法”进程中的恶意活动。

技术解析

  • 无头浏览器劫持与CDP控制:msaRAT在Rust中实现,首先通过环境变量或注册表查找Chrome/Edge,随后以--headless=new模式启动独立用户配置文件的浏览器实例。它通过CDP连接本地调试端口,禁用内容安全策略(CSP),并注入JavaScript以建立通信基础。
  • 隐蔽的WebRTC C2通道:恶意脚本从Cloudflare Worker获取STUN/TURN配置,伪装成Microsoft流量。由于服务器返回无效的ICE候选,强制所有流量通过Twilio的TURN中继服务器。这种设计使得网络流量看起来像是合法的浏览器访问Cloudflare和Twilio,攻击者服务器IP完全隐藏。
  • 双重加密与命令执行:通信层使用DTLS加密,内部应用层使用基于ECDH密钥交换的ChaCha-Poly1305方案。接收到的命令帧被传递给cmd.exe执行,支持大Payload传输(如截图或文件),具备可靠的流控机制。
  • 投递与持久化:通过单条curl命令下载伪装成Windows更新的MSI文件,利用自定义动作将嵌入的DLL直接加载到内存中运行。该过程利用了防火墙仅检查端口而忽略协议内容的弱点。

行业启示

  • 防御视角的转变:传统的网络边界防御难以检测此类流量,因为所有通信均源自合法的浏览器进程。安全团队需加强对本地进程行为的监控,特别是针对无头模式启动和远程调试端口的异常使用。
  • 滥用合法SaaS基础设施:攻击者正越来越多地利用Cloudflare Workers、Twilio TURN等广泛使用的合法云服务作为C2中继或信令服务器。组织不应简单地阻断这些域名,而应结合应用层检测和上下文感知分析来识别异常模式。
  • 行为检测优于签名检测:由于msaRAT不利用浏览器漏洞且代码动态加载,静态特征极易变化。检测策略应聚焦于进程创建参数(如--remote-debugging-port)、父子进程关系异常以及特定的CDP API调用序列(如Runtime.addBinding)。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全