Chaos Ransomware Exploits Chrome and Edge to Create Covert Command Channel

Key Takeaways

• The Chaos ransomware group is employing a novel remote-access tool, msaRAT, to establish covert command-and-control (C2) channels.
• msaRAT hijacks legitimate web browsers like Google Chrome and Microsoft Edge, using their built-in functionalities to communicate with attackers.
• This “living off the browser” technique makes detection challenging for traditional security tools, as malicious traffic blends with normal web activity.
• The attack chain typically begins with phishing or vishing, followed by the deployment of a memory-resident malware disguised as a software update.
• Defenders need to enhance monitoring for unusual browser behavior, especially headless mode launches and unexpected WebRTC connections.

Chaos Ransomware Evolves with Covert Browser-Based Command Channel

The notorious Chaos ransomware group has unveiled a sophisticated new method for concealing its malicious operations: leveraging common web browsers, specifically Google Chrome and Microsoft Edge, to establish an unseen command-and-control (C2) channel. This innovative approach, utilizing a remote-access tool (RAT) dubbed msaRAT, allows attackers to blend their activities seamlessly into ordinary web traffic, making detection significantly more difficult for conventional security mechanisms.

This tactic mirrors the stealth concerns previously associated with fake Chrome update malware campaigns, though with a critical distinction. Instead of using the browser as an initial lure, Chaos weaponizes it post-compromise, transforming it into an invisible conduit for command reception and data exfiltration. This “living off the browser” strategy presents a significant challenge for cybersecurity defenses, as documented in a comprehensive report by Cisco Talos.

The Rise of Chaos Ransomware and msaRAT

First identified in February 2025, the Chaos ransomware-as-a-service (RaaS) collective has gained notoriety for its double-extortion attacks targeting major organizations. The group typically infiltrates victim networks through social engineering tactics such as spam emails and voice phishing. Once inside, they deploy remote-management tools and legitimate file-sharing services to maintain persistence and steal sensitive data before initiating the ransomware payload.

Cisco Talos, in a report shared with Cyber Security News (CSN), pinpointed msaRAT as a Rust-based malware directly linked to the Chaos group. The name msaRAT derives from internal code labels like msaOpen, msaClose, msaError, and msaMessage, which facilitate the malware’s interaction with the compromised browser. The ability of msaRAT to masquerade its network communications as legitimate browser activity means that security analysts may observe seemingly innocuous browser traffic rather than the tell-tale signs of a malicious process contacting an attacker-controlled server. This significantly prolongs the attackers’ dwell time before the ransomware is deployed, increasing the potential for data theft and encryption.

How msaRAT Exploits Browsers

Upon successfully breaching a victim’s system, Chaos deploys a Windows installer disguised as a legitimate software update. This installer is designed to load a malicious library, lib.dll, directly into memory. This fileless execution technique minimizes forensic artifacts, making it harder for traditional endpoint security tools to detect.

Once active, msaRAT scans the compromised machine for installations of Chrome or Edge. If either browser is found, the malware launches it in a “headless” mode. This allows the browser to run without a visible graphical interface, effectively operating in the background. Concurrently, msaRAT enables the browser’s remote debugging interface, a feature primarily intended for developers.

Leveraging the Chrome DevTools Protocol, msaRAT then initiates a new browser session and injects JavaScript code into a fresh tab. This injected script communicates with a Cloudflare Workers endpoint to retrieve connection parameters, subsequently establishing a WebRTC data channel. WebRTC (Web Real-Time Communication) is a widely adopted standard for real-time browser-to-browser communication, making its use by msaRAT incredibly effective at blending in with legitimate network traffic generated by web applications and collaboration platforms.

To further obscure their tracks, the attackers route the WebRTC connection through a TURN (Traversal Using Relays around NAT) relay. This prevents a direct connection to their C2 server, effectively masking its true IP address. The communication is also doubly encrypted: WebRTC provides transport layer encryption, and msaRAT adds an additional layer of encryption to the data before it’s passed through the browser. This intricate design ensures that the core malware process only communicates locally, while the browser handles all external requests, appearing to contact legitimate Cloudflare and Google infrastructure. This sophisticated evasion technique presents challenges similar to those found in other browser-based ransomware abuse cases and “Ghost Calls” command channels, where legitimate communication technologies are co-opted for malicious purposes.

What You Should Do

• Enhanced Monitoring for Browser Anomalies: Implement robust monitoring for unusual browser process launches, especially those with “headless” or “remote-debugging” parameters, on systems not typically requiring such functionalities.
• Inspect WebRTC Connections: Investigate unexpected WebRTC connections originating from browser processes, particularly if they occur shortly after an MSI installer or a purported software update has run.
• Deep Packet Inspection: Do not rely solely on port numbers for network traffic analysis. Employ deep packet inspection to analyze web traffic by protocol, as the initial malicious download in this campaign uses plain HTTP over port 443, which might otherwise be overlooked.
• Limit Remote Management Tools: Restrict the use of unnecessary remote-management software and enforce strong, phishing-resistant multi-factor authentication for all remote access.
• Monitor File-Sharing Platforms: Actively monitor legitimate file-sharing platforms for unexpected or large-scale data transfers, which could indicate data exfiltration.
• Correlate Telemetry Data: Integrate and correlate browser telemetry, endpoint process trees, and installer activity logs. A single indicator might not reveal the full attack chain, but combined data can provide a clearer picture.
• Validate and Deploy Detections: Ensure that your security solutions, such as ClamAV and Snort, have the latest signatures (e.g., ClamAV signature Win.Downloader.ChaosRaas-10060321-0 and Snort rules 1:66840, 1:66841, 1:66839 for Snort 2; 1:301587, 1:66839 for Snort 3) for this threat. Conduct regular threat hunting using the provided indicators of compromise (IoCs).
• Rapid Incident Response: If malicious installer activity or abnormal headless browser behavior is detected, immediately isolate affected systems to prevent further compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.