Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Cisco Talos discovered msaRAT, a Rust-based remote access trojan used by Chaos ransomware to route command-and-control traffic through the victim's own web browser. The implant establishes no direct outbound connections, instead communicating exclusively with localhost (127.0.0.1) and leveraging headless instances of Chrome or Edge to handle all C2 communications.

This approach obscures malicious traffic by routing it through legitimate browser processes, making detection harder for network monitoring tools. The implant remains dormant on disk until activated, then instructs the headless browser to fetch commands and exfiltrate data. Cisco Talos identified msaRAT on compromised Windows machines shortly before Chaos deployed its encryption payload.

The technique represents an evasion advancement in ransomware deployment. By proxying C2 through a browser process rather than executing direct connections, Chaos avoids common detection signatures tied to suspicious outbound traffic. Network defenders accustomed to blocking known C2 domains face challenges when traffic flows through legitimate browser user-agents.

For organisations, msaRAT's presence signals an active compromise requiring immediate containment. Its discovery indicates the attacker has already achieved code execution and persistence on the system. The implant's use of headless browsers suggests the threat actor conducted reconnaissance before deploying ransomware, allowing time for lateral movement and data exfiltration.

Defenders should monitor for suspicious headless browser processes spawned by unexpected parents, unusual localhost listening sockets, and process injection into Chrome or Edge. Log aggregation systems should flag browser processes started without user interaction or graphical sessions. EDR platforms capable of process behavior analysis can identify the characteristic communication pattern between msaRAT and its browser proxies.

Organisations running vulnerable Windows systems should assume that any msaRAT detection precedes encryption attacks. Isolation of affected