# Chaos Ransomware Exploits Browsers for Stealthy Command Channels

*Published July 24, 2026*
*Source: [https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html](https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html)*

## Executive Summary

The Chaos ransomware group has developed a method to route command-and-control communications through a victim's browser using msaRAT, complicating detection. This approach disguises malicious traffic as legitimate browser activity, making it difficult to identify using traditional network-based controls.

## Article

The Chaos ransomware group has employed an innovative method to route their command-and-control (C2) communications through the victim's browser, complicating detection efforts. This approach utilizes msaRAT, a Rust-based implant, which Cisco Talos recently detailed after discovering it on a compromised Windows machine. The implant engages Chrome or Edge in headless mode, leveraging the Chrome DevTools Protocol (CDP) to avoid direct outbound connections. This technique allows C2 messages to be relayed through a WebRTC data channel via Twilio's TURN service, masking the attacker's server address.

msaRAT operates by first searching for Chrome or Edge using environment variables, then falls back to the registry if necessary. Upon finding a browser, it initiates a headless session with remote debugging capabilities, using a separate user data directory to bypass Google's security changes. The malware connects to a debuggable target via a WebSocket URL, utilizing JavaScript stored within the binary to manage communications. This script fetches configurations from a Cloudflare Worker, disguising traffic headers as originating from Microsoft to establish a peer connection.

The communication channel is encrypted twice, using DTLS for the outer layer and a ChaCha-Poly1305-based scheme for the inner layer, initiated by an ECDH exchange. Commands are executed through cmd.exe, and the implant is capable of handling large data payloads like screenshots or files. The method's effectiveness lies in its ability to disguise malicious activity as legitimate browser traffic, making it challenging to detect.

msaRAT is deployed post-compromise, using a simple curl command to download a malicious MSI file that impersonates a Windows update. This file contains a DLL written in Rust, which executes the implant's functions. The key to detection lies in monitoring process behaviors, such as browsers launched by non-interactive processes with specific debugging parameters. While Talos has provided some indicators of compromise, they note the ease with which attackers can alter these details, emphasizing the importance of recognizing the underlying technique.