The Chaos ransomware group has devised a novel method to manage command-and-control (C2) traffic using the victim’s own web browser. Cisco Talos recently uncovered the Rust-based msaRAT implant, which was detected on a compromised Windows system prior to encryption activities.
Innovative Command-and-Control Method
The msaRAT implant operates without initiating any outbound connections itself. Instead, it communicates with the local host address 127.0.0.1, employing Chrome or Edge in a headless mode through the Chrome DevTools Protocol (CDP). This technique facilitates the transmission of C2 messages via a WebRTC data channel, relayed by Twilio’s TURN service. Consequently, network defenders observe browser traffic directed to Cloudflare and Twilio, obscuring the attacker’s server address.
Technical Details of msaRAT Operations
msaRAT first searches for Chrome or Edge through environment variables and then checks the registry if necessary. Upon finding a compatible browser, it initiates it in headless mode, utilizing specific flags to enable remote debugging and point to a distinct user data directory. Google’s Chrome 136 update, which prevents debugging against the default profile, does not hinder msaRAT as it uses its own profile directory.
The implant requests a debuggable target and connects to the returned WebSocket URL, creating a new tab and disabling Content Security Policy. It registers multiple callbacks and injects JavaScript to facilitate communication. This script retrieves STUN and TURN configurations from a Cloudflare Worker, masked as Microsoft site traffic, establishing a peer connection through Twilio’s relay.
Security Implications and Defensive Measures
msaRAT’s deployment follows initial system compromise, taking place before encryption begins. Although Cisco Talos has not disclosed the specific attack vector, common tactics include spam, vishing, Quick Assist, and remote management tools. The implant is delivered via a simple curl command, masquerading as a legitimate Windows update.
Defense against msaRAT involves monitoring browser behaviors, particularly non-interactive launches of Chrome or Edge in headless mode. Correlating such processes with loopback traffic and outbound WebRTC communications is crucial. Although no file hashes for msaRAT are publicly available, Talos provides network indicators such as a staging IP and a Worker hostname.
This report highlights the strategic use of headless browsers in cyberattacks. While the specific victim and the extent of msaRAT’s deployment remain undisclosed, the reliance on legitimate services like Cloudflare and Twilio emphasizes the need for vigilant network monitoring and robust cybersecurity practices.
