Essential Insights
- The msaRAT malware uses headless Chrome/Edge browsers driven via Chrome DevTools Protocol to establish covert WebRTC-based command-and-control channels relayed through Twilio, making detection difficult.
- It arrives through seemingly benign MSI downloads disguised as Windows updates, executing a Rust-based DLL that sets up the headless browser and C2 communication without exploiting browser vulnerabilities.
- Detection hinges on behavioral indicators such as process behaviors involving headless browser launches with debugging flags and loopback traffic, rather than traditional malware signatures or exploits.
The Threat, Attack Techniques, and Targets
The Chaos ransomware group uses a new method involving msaRAT, a Rust implant, to manage its command-and-control (C2) traffic. The malware is found on a compromised Windows machine before encryption begins. It does not establish outbound connections directly. Instead, it launches Chrome or Edge in headless mode. It communicates with its C2 through the browser using the Chrome DevTools Protocol (CDP). The messages are sent via a WebRTC data channel relayed through Twilio’s TURN service. This way, no direct server address appears on the network, making detection harder. The malware searches for the browsers using environment variables or the registry. If found, it starts the browser with specific flags and injects JavaScript to set up peer-to-peer connections. The attack relies on the browsers’ debugging features and custom profiles, which bypass recent Chrome security updates. The malware arrives after the attacker has gained initial access, often through spam, vishing, remote management tools, or other methods. Once inside, the attacker downloads the malware using a fake Windows update MSI, which loads a Rust DLL to execute msaRAT. The technique focuses on covert C2 communication, not exploiting browser vulnerabilities directly.
Impact, Security Implications, and Remediation Guidance
This malware affects organizations by maintaining covert control over compromised systems. Its method of routing C2 traffic through browsers and relays makes detection difficult. Standard network monitoring tools may not identify malicious activity because traffic looks like legitimate browser sessions. Since msaRAT is used post-compromise, there is no specific browser vulnerability involved. The primary indicator is unusual process behavior, such as headless browsing or WebRTC traffic from non-interactive processes. Defenders should monitor for processes launching Chrome or Edge with debugging flags and correlate them with loopback traffic or WebRTC data channels. The malware leaves few static indicators but may generate network artifacts like connections to specific staging IPs or Cloudflare Worker URLs. For remediation, organizations should consult their security vendors or trusted authorities on detection techniques, as no direct patch exists for this method. Network security controls that block suspicious outbound WebRTC and cloud relay traffic may help reduce the risk.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
