Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Chaos ransomware group utilizes msaRAT, a Rust-based implant that routes Command-and-Control (C2) traffic through headless Chrome or Edge browsers via the Chrome DevTools Protocol (CDP). The malware avoids direct outbound connections by leveraging WebRTC data channels relayed through Twilio’s TURN service, masking attacker infrastructure behind legitimate Cloudflare and Twilio traffic. msaRAT injects JavaScript into the browser to bypass Content Security Policy and establish encrypted tunnels us
Analysis
TL;DR
- Chaos ransomware group utilizes msaRAT, a Rust-based implant that routes Command-and-Control (C2) traffic through headless Chrome or Edge browsers via the Chrome DevTools Protocol (CDP).
- The malware avoids direct outbound connections by leveraging WebRTC data channels relayed through Twilio’s TURN service, masking attacker infrastructure behind legitimate Cloudflare and Twilio traffic.
- msaRAT injects JavaScript into the browser to bypass Content Security Policy and establish encrypted tunnels using DTLS and ChaCha-Poly1305, executing commands via cmd.exe.
- Detection relies on behavioral analysis rather than file hashes, specifically looking for non-interactive processes launching browsers with
--headless=newand--remote-debugging-portflags. - The technique exploits firewall rules that allow port 443 traffic without deep packet inspection, allowing the initial MSI payload to download the DLL undetected.
Why It Matters
This tradecraft represents a significant evolution in evasion techniques by blending legitimate browser automation features with malicious C2 infrastructure, making it difficult for traditional network security tools to distinguish between benign web traffic and malware communication. For AI practitioners and security researchers, it highlights the critical importance of behavioral telemetry and process lineage monitoring over static signature-based detection, especially as attackers increasingly abuse cloud services like Cloudflare Workers and Twilio for infrastructure hiding.
Technical Details
- Implant Architecture: msaRAT is written in Rust using the Tokio async runtime. It is delivered via an MSI installer disguised as a Windows update, which loads an embedded DLL into memory upon installation.
- Browser Hijacking: The malware searches for Chrome or Edge via environment variables or registry keys, then launches them in headless mode (
--headless=new) with remote debugging enabled (--remote-debugging-port). It uses a separate user-data directory to avoid detection by recent Chrome security changes regarding default profiles. - Communication Channel: CDP is used to inject JavaScript that fetches STUN/TURN configurations from a Cloudflare Worker. The malware establishes a WebRTC peer connection, forcing all traffic through Twilio’s global TURN server (
global.turn.twilio.com) by returning an SDP answer with no ICE candidates and a0.0.0.0address. - Encryption and Execution: Traffic is double-encrypted: DTLS handled by the browser and an inner layer using ChaCha-Poly1305 keyed by an ECDH exchange initiated with a
0xFEhandshake frame. Incoming commands are executed viacmd.exe /e:ON /v:OFF /d /c <cmd>. - Detection Signals: Key indicators include
Runtime.addBindingandRuntime.evaluatecalls via CDP, loopback traffic to debugging ports, and outbound WebRTC traffic from browser processes spawned by non-interactive parents (installers, services).
Industry Insight
- Shift to Behavioral Detection: Organizations must move beyond port-based firewall rules and implement deep packet inspection or behavioral analytics to detect WebRTC and CDP anomalies, as attackers are effectively using legitimate protocols to tunnel malicious traffic.
- Cloud Infrastructure Abuse: The reliance on Cloudflare Workers and Twilio TURN services demonstrates how attackers leverage trusted, high-bandwidth cloud infrastructure to obscure their C2 servers. Security teams should monitor for unusual WebRTC signaling patterns originating from internal endpoints, even if the external destinations are reputable services.
- Endpoint Hardening: Since this is a post-compromise tool that does not exploit browser vulnerabilities, patching browsers alone is insufficient. Defense strategies should focus on restricting the execution of headless browser instances with debugging ports enabled, particularly when launched by non-browser processes, and enforcing strict application control policies on MSI installers.
Disclaimer: The above content is generated by AI and is for reference only.