Chaos ransomware crew hides its remote control tool inside your own browser
A new backdoor called msaRAT launches Chrome or Edge in the background and pipes attacker commands through it, so no direct link to the criminal server ever appears on the network.
Key points
- Cisco Talos has documented a new backdoor called msaRAT, used by the Chaos ransomware gang since 2025, that routes attacker traffic through Chrome or Microsoft Edge.
- The malware starts the browser invisibly and controls it using Chrome DevTools Protocol, a built-in developer feature normally used to test websites.
- All communication is bounced through Cloudflare Workers and Twilio's TURN servers, hiding the attacker's real server address from firewalls.
- Attacks begin with email or phone phishing, followed by a fake Windows update installer that loads msaRAT straight into memory.
- Two layers of encryption, one from the browser and one added by msaRAT, wrap the traffic so network defenders see only ordinary looking web activity.
A ransomware group is turning your own web browser into its getaway car.
Researchers at Cisco Talos have pulled apart a new backdoor, first reported by BleepingComputer, that the Chaos ransomware crew is using to control infected Windows machines. It is called msaRAT, and its trick is simple to describe and nasty to defend against: instead of phoning home to a criminal server the way malware normally does, it opens Chrome or Microsoft Edge in the background and lets the browser do the talking.
To the network, it looks like someone is just browsing the web.
How does the attack actually start?
It starts with a person being tricked. The Chaos gang begins each intrusion with phishing, meaning fake emails, or vishing, meaning fake phone calls where the caller pretends to be IT support. Once a victim is on the hook, the attackers install legitimate remote management software so they can keep a foothold.
Next they drop what looks like a Windows update. It is actually an MSI installer that loads msaRAT (a file called lib.dll) directly into the computer's memory, leaving less on disk for antivirus to spot.
This is the point where multi-factor authentication would have helped at the front door, but only if the initial access relied on stolen credentials. Against a user who runs a malicious installer themselves, MFA does nothing.
Why is hiding traffic in the browser such a problem?
Because the browser is trusted. Most companies allow Chrome and Edge to talk to the internet freely. Blocking them would break everyone's work.
msaRAT is written in Rust and uses the Chrome DevTools Protocol, a feature normally used by developers to test and debug websites. It launches the browser in headless mode, which means the browser runs without a visible window on screen. The user sees nothing.
It then opens a tab, injects JavaScript into that tab, and uses the browser itself to reach out to the attacker's infrastructure.
Where does the traffic actually go?
Through two legitimate cloud services. The browser first contacts a Cloudflare Workers address (is-01-ast.ols-img-12.workers.dev) to fetch connection details. Then it sets up an encrypted WebRTC channel, the same technology that powers video calls in your browser, relayed through Twilio's TURN servers.
Talos notes the malware deliberately omits certain settings so that direct peer-to-peer connections cannot form. Everything is forced through Twilio's relay. That means the real IP address of the criminal's server never appears in your firewall logs.
There are two layers of encryption on top: the browser's own DTLS, and a second layer using ChaCha20-Poly1305 added by msaRAT. A defender staring at the network sees ordinary encrypted web traffic to Cloudflare and Twilio, both services that thousands of legitimate businesses rely on every day.
| Detail | What Talos found |
|---|---|
| Malware name | msaRAT |
| Written in | Rust |
| Loaded as | lib.dll, in memory |
| Delivery | Fake Windows update MSI |
| Signaling relay | Cloudflare Workers subdomain |
| Traffic relay | Twilio TURN servers |
What can defenders and ordinary users do?
For home users, the practical advice is unchanged. Do not run installers that arrive by email. Be suspicious of anyone who calls claiming to be from your IT department and asks you to click, download or install anything.
For security teams, this is a reminder that blocking known bad IP addresses is not enough when the bad traffic hides behind Cloudflare and Twilio. Watching for Chrome or Edge being launched by unusual parent processes, or with remote debugging flags turned on, is more useful than watching the network alone. Cisco Talos has published indicators of compromise for teams to feed into their detection tools.
