New msaRAT Malware Uses Chrome and Edge to Hide C2 Traffic

The Chaos ransomware group is using a new Rust-based backdoor called msaRAT to hide command-and-control traffic inside Chrome and Microsoft Edge browser activity.

The msaRAT malware launches a headless browser session and uses the Chrome DevTools Protocol to communicate with attacker-controlled infrastructure. Because it routes traffic through the browser rather than connecting directly to a command-and-control server, the malware can make detection more difficult.

Researchers found that the malware also uses Cloudflare Workers and Twilio TURN servers to conceal the attacker’s infrastructure and prevent direct connections to the malicious server.

msaRAT Uses Browsers as a C2 Proxy

After launching, msaRAT searches for Google Chrome or Microsoft Edge on the compromised device.

It then starts the browser in headless mode, which allows it to run without displaying a visible browser window. Next, the malware enables the browser’s remote debugging interface and connects to it through the Chrome DevTools Protocol.

The backdoor opens a new browser tab and injects JavaScript through DevTools commands. This code creates the communication channel, bypasses Chrome’s Content Security Policy and registers functions that support further communication.

As a result, the malware can exchange commands and data without creating a direct network connection between the infected system and the attacker’s server.

Cloudflare and Twilio Help Conceal Infrastructure

The browser contacts a Cloudflare Workers endpoint to retrieve the information needed to establish an encrypted WebRTC connection.

Researchers said msaRAT uses two encryption layers. WebRTC provides DTLS encryption through the browser, while the malware adds ChaCha20-Poly1305 encryption with ECDH key exchange.

The malware routes its traffic through Twilio TURN servers rather than allowing direct peer-to-peer WebRTC connections.

Normally, WebRTC can establish a direct connection between two endpoints. However, msaRAT deliberately omits connection information that would enable that behaviour. This forces all communication through the TURN relay service.

That design prevents the attacker’s real server IP address from appearing in network traffic. Instead, defenders may see connections to legitimate Cloudflare and Twilio infrastructure.

Chaos Ransomware Group Uses Phishing Attacks

Chaos emerged in early 2025 and is not connected to the older ransomware family with the same name.

Earlier research linked Chaos activity to Iranian state-backed actors known as MuddyWater, which allegedly used the ransomware operation to disguise cyber-espionage as financially motivated crime.

More recent attacks began with email phishing or voice phishing. Attackers then installed remote management software to maintain access to the victim’s environment.

After gaining access, the operators downloaded an MSI installer disguised as a Windows update. The installer loaded the msaRAT payload, identified as lib.dll, directly into system memory.

Browser-Based C2 Makes Detection Harder

The msaRAT malware divides its communications into data chunks called frames. These frames support functions such as key exchanges, opening and closing channels, resetting sessions and executing Windows commands.

By hiding traffic inside regular browser processes and web services, the malware can blend into activity that many organisations already allow through firewalls and security tools.

Blocking Cloudflare’s free workers.dev subdomains is also difficult. Many legitimate developers and services rely on Cloudflare Workers, so broad blocks could disrupt normal business activity.

Security teams should investigate unexpected headless Chrome or Edge processes, unusual browser debugging activity and suspicious outbound connections involving Cloudflare Workers or TURN relay services. The msaRAT malware shows how attackers can abuse trusted browser technologies to conceal command-and-control traffic.