The Chaos ransomware gang has unleashed a new backdoor dubbed msaRAT that leverages popular web browsers like Chrome and Edge to route command-and-control (C2) traffic. This sophisticated malware, written in Rust, employs the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker’s server without making any direct connections to the C2 infrastructure.
The Chaos ransomware group emerged on the scene earlier this year, separate from the well-known ransomware family with the same name that existed since 2021. Researchers at Rapid7 discovered that Chaos was being used by Iranian state-backed hackers ‘MuddyWater’ to disguise their cyber-espionage operations as financially motivated attacks. More recent attacks observed by the Cisco Talos research team began through email or voice phishing, followed by the installation of remote management software to establish persistence.
Once inside the environment, the attacker downloaded an MSI installer posing as a Windows update, which loads msaRAT (lib.dll) directly into system memory. The malware then searches for Chrome or Microsoft Edge and launches the browser in headless mode, enabling the remote debugging interface and connecting to it via CDP. This allows the injected JavaScript to build the communication channel, bypassing Chrome’s Content Security Policy (CSP), and registering several CDP bindings that enable communications.
To add an extra layer of complexity, the browser contacts a Cloudflare Workers endpoint to obtain WebRTC connection information and establish an encrypted channel. There are two layers of encryption in play: the WebRTC DTLS, automatically provided by the browser, and ChaCha20-Poly1305 + ECDH key, implemented by msaRAT. The communication is relayed through Twilio TURN servers with a specific configuration to avoid direct peer-to-peer connections.
What’s particularly concerning about this approach is that it makes detection significantly more difficult. By routing traffic through Twilio’s legitimate service and combining it with Cloudflare Workers, the real IP address of the attacker’s server never appears in the network traffic. This dual-layer infrastructure makes it challenging for security teams to trace the attacker’s infrastructure.
The researchers documented how the data exchange system works by breaking down messages into chunks called “frames,” which include key exchanges, channel opening/closing, session resets, and Windows command execution. The use of Cloudflare Workers as the signaling relay ensures that the attacker’s server remains protected, as the destination IP address is assigned to Cloudflare’s infrastructure.
As we’ve seen time and time again, threat actors are continually evolving their tactics to evade detection and stay one step ahead of security teams. This new msaRAT backdoor is a prime example of how they’re using legitimate services like Cloudflare Workers to mask their malicious activities. To mitigate this risk, it’s essential for organizations to implement robust security measures that include regular penetration testing and breach and attack simulation exercises to test their SIEM and EDR rules. This will help them stay ahead of threats like msaRAT and prevent successful attacks from slipping through the cracks.
Source: Bleeping Computer — 2026-07-23