Executive Summary
Cisco Talos has identified a novel Rust-based implant named msaRAT, attributed to the Chaos ransomware group (also known as Chaos RaaS). The malware represents a sophisticated 'living-off-the-browser' evolution, where the implant itself never initiates direct outbound network connections. Instead, it operates locally on loopback (127.0.0.1) and drives a headless instance of Google Chrome or Microsoft Edge to handle all external communications.
Technically, msaRAT leverages the Chrome DevTools Protocol (CDP) to inject JavaScript into the browser. This script initiates a WebRTC DataChannel for Command and Control (C2), using Cloudflare Workers for signaling and Twilio’s TURN services as a relay. This architecture ensures that network defenders only see legitimate browser traffic to trusted infrastructure providers, effectively masking the attacker's true origin.
This development is significant because it bypasses traditional network-layer inspections that look for suspicious outbound sockets from non-browser processes. As Chaos continues to target large organizations with double extortion tactics, the use of msaRAT as a precursor to encryption poses a high risk for undetected data exfiltration and persistent remote access.