# Chaos Ransomware's msaRAT Hides Inside Your Browser — and You Can't Block It
There's no mystery connection to a sketchy foreign IP. No unusual process spawning a raw socket at 3 AM. The Chaos ransomware gang's new backdoor talks to its operators through Chrome. Your Chrome. And that is exactly the problem.
Cisco Talos published research this week on msaRAT, a Rust-written backdoor deployed by Chaos ransomware operators that never touches the network directly. Instead, it hijacks a running Chrome or Edge installation — or launches one in headless mode, invisible to the user — and routes all command-and-control communication through the browser process itself. From every network monitoring tool's perspective, the traffic looks like Chrome doing Chrome things.
## What the Malware Actually Does to Your Browser
The infection chain isn't exotic at the entry point: phishing email or voice call, then a remote management tool dropped for persistence, then an MSI disguised as a Windows update that loads lib.dll — msaRAT — directly into system memory, no file on disk. Standard ransomware operator playbook through that point.
The novelty is what happens next.
msaRAT locates Chrome or Edge, launches it in headless mode (no visible window), and connects to the browser's remote debugging interface via the Chrome DevTools Protocol — the same protocol developers use to run automated tests and profile JavaScript performance. Once it has that handle, it injects JavaScript into a new browser tab.
That injected JavaScript does three things: establishes the communication channel, bypasses Chrome's Content Security Policy, and registers CDP bindings that let the malware send and receive data through the browser's own runtime.
The browser then contacts a Cloudflare Workers endpoint to retrieve WebRTC connection information. All subsequent traffic runs through Twilio TURN servers — and here's the specifically clever part. Standard WebRTC negotiation includes ICE candidates that allow direct peer-to-peer connections between endpoints. msaRAT deliberately omits those candidates, which forces *all* traffic to relay through Twilio's infrastructure. The C2 server's real IP never appears in any packet.
The encryption is layered: WebRTC's built-in DTLS at the transport level, plus ChaCha20-Poly1305 with ECDH key exchange implemented by the malware itself. Two independent encryption passes, both inside traffic that looks like a browser session.
## The Cloudflare Workers Trap
The signaling relay runs on a *.workers.dev subdomain — the free subdomain Cloudflare gives every developer deploying a Workers function. The Talos team explicitly names the problem defenders face: blocking *.workers.dev would break countless legitimate Cloudflare Workers deployments. It's a flag the attacker is using intentionally.
This is the same logic behind using Twilio for TURN relay. Twilio's IP ranges are on allowlists everywhere. Security teams have deliberately carved out exceptions for these providers because blocking them breaks real business operations. The attacker isn't hiding behind an obscure bulletproof host — they're hiding behind services your SOC already decided to trust.
The data exchange itself is chunked into "frames" — discrete message types for key exchanges, channel open/close, session resets, and Windows command execution. It's a purpose-built protocol running inside WebRTC running inside Chrome running inside your endpoint. Every abstraction layer adds detection complexity.
## The MuddyWater Thread
The technical sophistication here doesn't come from nowhere. Earlier this year, Rapid7 documented Iranian state-backed group MuddyWater using the Chaos ransomware gang as cover — deploying ransomware to make espionage operations look financially motivated. Attribution gets muddied (intentionally), victim organizations assume they're dealing with opportunistic criminals, and the investigators optimize for remediation rather than intelligence collection.
msaRAT fits that picture. This is not a tool built for speed-and-volume ransomware campaigns. The browser-routing architecture requires careful engineering and accepts operational complexity in exchange for detection evasion. That's a different threat model than the groups that rip through a thousand SMBs a month. Whether MuddyWater is directly involved in these newer Chaos campaigns or the techniques have diffused into the gang's own operations, the tradecraft carries state-actor DNA.
---
## HackWire Analysis
msaRAT represents a meaningful escalation in a trend that's been building for two years: attackers abandoning custom C2 infrastructure in favor of legitimate service abuse. We've seen this with Slack channels, Telegram bots, Discord webhooks, and Google Docs used as dead drops. msaRAT takes it a step further — it doesn't just use a legitimate service as a relay, it commandeers the browser itself as the network interface.
The defender calculus here is genuinely difficult. You cannot block Chrome. You cannot block Cloudflare Workers or Twilio TURN without significant collateral damage. Traditional network-layer detection — looking for anomalous destinations, unusual ports, unexpected DNS queries — misses this entirely. The traffic is Chrome traffic, to Cloudflare, to Twilio. Every hop passes the smell test.
What this demands is a shift toward behavioral endpoint detection that can identify CDP being invoked by a non-standard process, or a headless browser spawning without a corresponding user action. EDR tools that track process lineage and API call patterns are the relevant control here, not firewalls.
The MuddyWater connection also deserves more attention than it's getting. We're watching a state actor's evasion techniques migrate into ransomware gang tooling — or watching a ransomware gang serve as cover for state operations — and the industry is treating this as a malware analysis story rather than a threat intelligence one. Organizations that are attractive espionage targets (defense contractors, government agencies, critical infrastructure) should not assume Chaos is just another ransomware crew. The msaRAT architecture suggests someone thought carefully about surviving inside a monitored network for a long time.
Immediate detection priorities: hunt for chrome.exe or msedge.exe processes spawned by unexpected parent processes, monitor for CDP port binding activity outside developer tooling contexts, and flag any process invoking remote debugging flags on browser binaries.
— HackWire Editorial
---