A New Era of Stealthy Malware: msaRAT Uses Browsers to Route C2 Traffic
Cybersecurity researchers have uncovered a sophisticated new backdoor dubbed msaRAT that is being used by the Chaos ransomware gang to evade detection and maintain control over compromised systems. What’s particularly noteworthy about this malware is its ability to route command-and-control (C2) communication through Chrome or Edge browsers, making it extremely difficult to detect.
The malware, written in Rust, uses the Chrome DevTools Protocol (CDP) to establish a connection with a headless browser session and ultimately connect to the attacker’s server. This clever technique allows msaRAT to conceal its C2 traffic within normal web traffic, significantly reducing the risk of detection by security software.
The Chaos ransomware group emerged earlier this year, linked to Iranian state-backed hackers known as MuddyWater, who used it to disguise their cyber-espionage operations as financially motivated attacks. More recent attacks have started with email or voice phishing and progressed to the installation of remote management software to establish persistence. Once inside, msaRAT was loaded directly into system memory via an MSI installer posing as a Windows update.
Once launched, msaRAT searches for Chrome or Edge and launches the browser in headless mode. It then enables the browser’s remote debugging interface and connects to it via CDP. After this step, it opens a new browser tab and injects JavaScript into it using CDP commands. This injected code is responsible for building the communication channel and registering several CDP bindings that enable communications.
The malware uses two layers of encryption: WebRTC DTLS provided by the browser and ChaCha20-Poly1305 + ECDH key implemented by msaRAT. Communication is relayed through Twilio TURN servers with a specific configuration to avoid direct peer-to-peer connections. By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in network traffic, making it significantly difficult to trace the attacker’s infrastructure.
The use of Cloudflare Workers as the signaling relay ensures that the attacker’s server remains protected, with the destination IP address assigned to Cloudflare’s infrastructure passing firewall and allowlist automatic verification. Moreover, blocking the “*workers.dev” free subdomain would disrupt legitimate Cloudflare Workers deployments and affect benign services.
The researchers have documented how the data exchange system works by breaking down messages into chunks called “frames,” which include key exchanges, channel opening/closing, session resets, and Windows command execution. This mechanism allows msaRAT to control C2 exchanges without touching the network directly and bury it within normal web traffic.
Security teams must be aware of this new threat vector and take measures to prevent such stealthy malware from compromising their systems. By testing every layer before attackers do, organizations can strengthen their defenses and reduce the risk of successful attacks slipping through detection.
Source: Bleeping Computer — 2026-07-23