Full Report
The Chaos ransomware group uses new malware "msaRAT" that hijacks browsers. The malware doesn't communicate directly with C2 but connects through the browser. It enables arbitrary command execution while hiding the attacker's IP from victims via WebRTC over TURN.
Analysis Summary
# Tool/Technique: msaRAT
## Overview
msaRAT is a sophisticated Rust-based Remote Access Trojan (RAT) attributed to the Chaos ransomware group. Its primary innovation lies in its "living off the browser" approach to command-and-control (C2). Instead of generating its own network traffic, it manipulates an installed browser via the Chrome DevTools Protocol (CDP) to establish a WebRTC DataChannel via WebRTC over TURN. This allows the malware to hide its C2 communications within legitimate browser processes, effectively bypassing network-based detection and masking the attacker's IP address.
## Technical Details
- **Type:** Malware (Remote Access Trojan)
- **Platform:** Windows
- **Capabilities:** Browser hijacking, arbitrary command execution (reverse shell), covert tunneling, and WebRTC-based communication.
- **First Seen:** Identified July 2026 (Reported activity associated with Chaos group starting February 2025).
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1105 - Ingress Tool Transfer]**: Downloading the MSI via curl.
- **[T1568.002 - Dynamic Resolution: Domain Generation Algorithms]**: (Contextual use of Workers/TURN for resolution).
- **[T1071.001 - Application Layer Protocol: Web Protocols]**: Using HTTP/HTTPS for initial download and signaling.
- **[T1539 - Steal Web Session Cookie/Browser Hijacking]**: Utilizing CDP to control browser networking.
- **[TA0002 - Execution]**
- **[T1059.001 - Command and Scripting Interpreter: PowerShell]**
- **[T1204.002 - User Execution: Malicious File]**: Execution of the MSI installer.
## Functionality
### Core Capabilities
- **Browser-Leveraged C2:** Uses the Chrome DevTools Protocol (CDP) to force the browser to perform networking tasks, ensuring the RAT process itself only communicates with `127.0.0.1`.
- **Remote Code Execution:** Provides a reverse shell for attackers to execute arbitrary system commands.
- **Asynchronous Execution:** Built on the Rust Tokio runtime for high-performance parallel task handling.
### Advanced Features
- **WebRTC Tunneling:** Establishes a peer-to-peer DataChannel via Twilio TURN (Traversal Using Relays around NAT), which bypasses traditional firewalls and disguises traffic as standard web media streaming.
- **Signaling via Cloudflare Workers:** Uses legitimate `*.workers.dev` infrastructure for the initial SDP (Session Description Protocol) handshake, making it difficult to block the C2 endpoint without impacting legitimate services.
- **Double Encryption:** Commands are encrypted before being passed to the browser, which then wraps them in standard WebRTC encryption (DTLS/SCTP).
## Indicators of Compromise
- **File Hashes (SHA256):**
- *msaRAT DLL:* `[See original report/GitHub for specific hashes]`
- *update_ms.msi:* `[See original report/GitHub for specific hashes]`
- **File Names:** `update_ms.msi`, `lib.dll`
- **Registry Keys:** (Not specified in summary, typically used for persistence).
- **Network Indicators:**
- `172.86.126[.]18:443` (Initial payload delivery via HTTP)
- `is-01-ast[.]ols-img-12[.]workers[.]dev` (Signaling relay)
- `127.0.0[.]1` (Internal communication between RAT and Browser)
- **Behavioral Indicators:**
- `curl.exe` downloading files to `C:\ProgramData\`.
- Legitimate browser processes (Chrome/Edge) initiating WebRTC connections to unusual TURN servers or Cloudflare Workers.
- Use of `--remote-debugging-port` flags on browser startup.
## Associated Threat Actors
- **Chaos Ransomware Group:** A RaaS (Ransomware-as-a-Service) operator known for double extortion and vishing techniques.
## Detection Methods
- **Signature-based:**
- ClamAV: `Win.Downloader.ChaosRaas-10060321-0`
- Snort SIDs: `66840`, `66841`, `66839`, `301587`
- **Behavioral:**
- Monitoring for unauthorized use of Chrome DevTools Protocol (CDP) by non-integrated processes.
- Alerting on browser processes launched with `remote-debugging` enabled via command line.
- Detecting `curl.exe` or `certutil.exe` activity in `C:\ProgramData\`.
## Mitigation Strategies
- **Endpoint Hardening:** Restrict the use of command-line tools like `curl.exe` and `powershell.exe` for standard users.
- **Protocol Inspection:** Use Firewalls/NGFWs with Deep Packet Inspection (DPI) to identify non-HTTP traffic (like TURN/STUN) on ports 80/443.
- **EDR Configuration:** Monitor for suspicious child processes of MSI installers and browser debugging API calls.
- **Network Filtering:** While difficult, monitoring for persistent connections to Cloudflare Workers or third-party TURN providers can reveal covert channels.
## Related Tools/Techniques
- **Living off the Browser:** Similar to "Living off the Land" but focusing exclusively on browser APIs for network stealth.
- **RMM Abuse:** Chaos frequently uses legitimate Remote Monitoring and Management tools for persistence.