Chaos Ransomware - WebRTC Signaling via Cloudflare Workers Endpoint

Georg Lauenstein@gsec

•updated Jul 29, 2026•7•0•27

Detects HTTP requests to a Cloudflare Workers subdomain (*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.