Ethical Hacking News
Recent breakthroughs in the cybersecurity world have highlighted a new tactic employed by the Chaos ransomware group: deploying browser-based msaRAT to evade network detection. This innovative approach relies on legitimate tools and protocols, making it challenging for defenders to detect and block. Understanding this emerging threat is crucial to staying ahead of evolving threats like msaRAT.
The Chaos ransomware group has deployed browser-based msaRAT (Remote Access Trojan) to evade network detection. msaRAT uses legitimate tools and protocols, such as Chrome DevTools Protocol and WebRTC, to hide its command-and-control traffic. The malware relies on a Cloudflare Workers endpoint to establish a WebRTC connection, providing double-layer encryption. To deploy msaRAT, attackers first gain access to a Windows machine through vulnerabilities or social engineering tactics. Detection signals for msaRAT include browser processes with remote-debugging flags and suspicious HTTP requests.
The cybersecurity landscape continues to evolve, and one of the most significant threats emerging recently is the Chaos ransomware group's deployment of browser-based msaRAT (Remote Access Trojan) to evade network detection. According to recent reports by Cisco Talos, this new tactic, tactics, and procedures (TTPs), was discovered in July 2026.
The msaRAT malware process itself does not establish any direct network connection; instead, it relies on the Chrome or Edge browser's debugging interface, known as Chrome DevTools Protocol (CDP), to hide its command-and-control (C2) traffic. This approach is particularly effective since CDP is a legitimate and commonly used tool for developers to inspect web pages.
msaRAT uses Cloudflare Workers endpoint to signal relay (SDP Offer/Answer exchange) for establishing a WebRTC (Web Real-Time Communication) connection, which then serves as the primary means of communication between the attacker's server and the infected browser. The WebRTC DataChannel is protected by DTLS (Datagram Transport Layer Security), ensuring double-layer encryption.
To deploy msaRAT, attackers first gain access to a Windows machine by exploiting vulnerabilities or using social engineering tactics. They then download an MSI file named update_ms.msi from an attacker-controlled server on port 443, though the traffic runs over plain HTTP. The MSI impersonates a Windows update and loads the RAT DLL directly into memory via a custom installer action.
The malware searches for Chrome or Edge through environment variables in a defined priority order, then falls back to a registry lookup for Chrome if nothing is found. If it finds a browser, msaRAT launches it in headless mode with remote debugging enabled, connects to it over the local debugging port, bypasses Content Security Policy using a CDP command, and injects JavaScript that handles all the actual network work.
The design of msaRAT ensures that all communication from the RAT process itself is limited to "127.0.0.1," while external communications are observed as originating from a legitimate browser process. This makes it difficult for defenders to detect and block the malware using traditional methods, as C2 traffic is effectively buried within normal web traffic.
Detection signals for msaRAT include a browser process spawned with remote-debugging flags from an MSI installer, curl.exe or certutil.exe activity in C:\ProgramData, and HeadlessChrome user-agent strings in HTTP requests. Cisco Talos has published a ClamAV signature (Win.Downloader.ChaosRaas-10060321-0) and Snort rules to help detect this emerging threat.
In conclusion, the deployment of browser-based msaRAT by the Chaos ransomware group marks an evolving threat landscape where attackers are increasingly utilizing legitimate tools and protocols to evade detection. As such, it is crucial for cybersecurity professionals to stay informed about emerging threats like msaRAT and adopt proactive measures to detect and block this malware.
Recent breakthroughs in the cybersecurity world have highlighted a new tactic employed by the Chaos ransomware group: deploying browser-based msaRAT to evade network detection. This innovative approach relies on legitimate tools and protocols, making it challenging for defenders to detect and block. Understanding this emerging threat is crucial to staying ahead of evolving threats like msaRAT.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Evolving-Threat-Landscape-Chaos-Ransomwares-Browser-Based-msaRAT-ehn.shtml
https://securityaffairs.com/195876/malware/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection.html
Published: Thu Jul 23 14:41:18 2026 by llama3.2 3B Q4_K_M
