Chaos ransomware crew hides its remote control tool inside your own browser
A new backdoor called msaRAT launches Chrome or Edge in the background and pipes attacker commands through it, so no direct link to the criminal server ever appears on the network.
Key points
- Cisco Talos has documented a new backdoor called msaRAT, used by the Chaos ransomware gang since 2025, that routes attacker traffic through Chrome or Microsoft Edge.
- The malware starts the browser invisibly and controls it using Chrome DevTools Protocol, a built-in developer feature normally used to test websites.
- All communication is bounced through Cloudflare Workers and Twilio's TURN servers, hiding the attacker's real server address from firewalls.
- Attacks begin with email or phone phishing, followed by a fake Windows update installer that loads msaRAT straight into memory.
- Two layers of encryption wrap the traffic: the browser's own DTLS and a second layer added by msaRAT, so defenders see only ordinary-looking web activity.
A ransomware group is turning your own web browser into its getaway car.
Researchers at Cisco Talos have pulled apart a new backdoor that the Chaos ransomware crew is using to control infected Windows machines. It's called msaRAT, and its trick is simple to describe and nasty to defend against: instead of phoning home to a criminal server directly, it opens Chrome or Microsoft Edge in the background and lets the browser do the talking. To the network, it looks like someone's just browsing the web. The Chaos ransomware group emerged in early 2025, unrelated to a same-named family that had existed since 2021.
How does the attack actually start?
It starts with a person being tricked. The Chaos gang begins each intrusion with phishing, fake emails, or vishing, where the caller pretends to be IT support. Once a victim is on the hook, the attackers install legitimate remote management software to keep a foothold.
Next they drop what looks like a Windows update. It's actually an MSI installer that loads msaRAT (a file called lib.dll) directly into the computer's memory, leaving less on disk for antivirus to spot. This is the point where multi-factor authentication would have helped at the front door, but only if initial access relied on stolen credentials. Against a user who runs a malicious installer themselves, MFA does nothing.
Why is hiding traffic in the browser such a problem?
Because the browser is trusted. Most organisations allow Chrome and Edge to talk to the internet freely; blocking them would break everyone's work.
MsaRAT is written in Rust and uses Chrome DevTools Protocol (CDP), a feature normally used by developers to debug websites. It launches the browser in headless mode, meaning the process runs without any visible window. The user sees nothing. It then opens a tab, injects JavaScript into it via CDP commands, and uses the browser itself to reach the attacker's infrastructure, a technique similar in spirit to the fake-installer approach we reported on 16 July, where UAT-11795 weaponised trusted software to smuggle a credential stealer past defenders.
Where does the traffic actually go?
Through two legitimate cloud services. The browser first contacts a Cloudflare Workers address (is-01-ast.ols-img-12.workers.dev) to fetch connection details. Then it sets up an encrypted WebRTC channel, the same technology that powers browser video calls, relayed through Twilio's TURN (Traversal Using Relays around NAT) servers.
By deliberately omitting certain settings, the malware prevents direct peer-to-peer connections from forming. Everything is forced through Twilio's relay, so the real IP address of the criminal's server never appears in firewall logs.
Two encryption layers sit on top: the browser's own DTLS and a second layer using ChaCha20-Poly1305 added by msaRAT. A defender staring at the network sees ordinary encrypted web traffic to Cloudflare and Twilio, both services thousands of legitimate businesses use daily.
| Detail | What Talos found |
|---|---|
| Malware name | msaRAT |
| Written in | Rust |
| Loaded as | lib.dll, in memory |
| Delivery | Fake Windows update MSI |
| Signaling relay | Cloudflare Workers subdomain |
| Traffic relay | Twilio TURN servers |
What can defenders and ordinary users do?
For home users, the practical advice is unchanged: don't run installers that arrive by email, and treat any unsolicited call from someone claiming to be IT support as suspicious.
For security teams, blocking known bad IP addresses is beside the point when traffic hides behind Cloudflare and Twilio. Watching for Chrome or Edge launched by unusual parent processes, or with remote debugging flags enabled, is more useful than watching the network alone. Talos has published indicators of compromise for teams to feed into detection tools.
The blunt assessment: this is the most friction-free C2 concealment technique I've seen documented against Windows targets this year. The attacker doesn't need to build or maintain anything exotic. They're renting infrastructure that most corporate firewalls are contractually obliged to allow through.
