The Chaos ransomware group has employed an innovative method to route their command-and-control (C2) communications through the victim's browser, complicating detection efforts. This approach utilizes msaRAT, a Rust-based implant, which Cisco Talos recently detailed after discovering it on a compromised Windows machine. The implant engages Chrome or Edge in headless mode, leveraging the Chrome DevTools Protocol (CDP) to avoid direct outbound connections. This technique allows C2 messages to be relayed through a WebRTC data channel via Twilio's TURN service, masking the attacker's server address.
msaRAT operates by first searching for Chrome or Edge using environment variables, then falls back to the registry if necessary. Upon finding a browser, it initiates a headless session with remote debugging capabilities, using a separate user data directory to bypass Google's security changes. The malware connects to a debuggable target via a WebSocket URL, utilizing JavaScript stored within the binary to manage communications. This script fetches configurations from a Cloudflare Worker, disguising traffic headers as originating from Microsoft to establish a peer connection.
The communication channel is encrypted twice, using DTLS for the outer layer and a ChaCha-Poly1305-based scheme for the inner layer, initiated by an ECDH exchange. Commands are executed through cmd.exe, and the implant is capable of handling large data payloads like screenshots or files. The method's effectiveness lies in its ability to disguise malicious activity as legitimate browser traffic, making it challenging to detect.
msaRAT is deployed post-compromise, using a simple curl command to download a malicious MSI file that impersonates a Windows update. This file contains a DLL written in Rust, which executes the implant's functions. The key to detection lies in monitoring process behaviors, such as browsers launched by non-interactive processes with specific debugging parameters. While Talos has provided some indicators of compromise, they note the ease with which attackers can alter these details, emphasizing the importance of recognizing the underlying technique.