A New Way to Hide in Plain Sight

Cisco Talos researchers have uncovered a fresh technique from the Chaos ransomware group that turns your own web browser into a covert communication channel. The tool, called msaRAT, is a remote access trojan written in Rust that drives a headless Chrome or Edge session using the Chrome DevTools Protocol (CDP). Instead of connecting directly to a command-and-control server the way most malware does, msaRAT routes its traffic through legitimate infrastructure operated by Cloudflare and Twilio, making the attacker's activity look like ordinary browser traffic rather than malicious network activity.

This discovery matters because it represents a meaningful shift in how ransomware groups evade detection. Rather than relying on custom protocols or suspicious domains that security tools are trained to flag, Chaos ransomware's operators are living off infrastructure that businesses trust and use every day. If you want the deeper technical breakdown of how msaRAT operates inside the browser process itself, we've previously covered how Chaos ransomware's msaRAT hides in Chrome and Edge in more detail.

How the Attack Actually Works

According to Cisco Talos, msaRAT was discovered on a compromised Windows machine, deployed as a precursor step before the actual ransomware encryptor was launched. This is a common pattern in modern ransomware operations: attackers first establish persistence and reconnaissance capabilities, then deploy the destructive payload once they've mapped out the network and identified valuable data.

What sets msaRAT apart is its use of CDP to control a headless instance of Chrome or Edge running silently in the background. By puppeteering a real browser process, the malware can relay encrypted command-and-control traffic through Twilio's TURN relay infrastructure, which is typically used for legitimate WebRTC applications like video calls and real-time communications. Because this traffic rides on Cloudflare and Twilio's networks, and because it resembles normal WebRTC signaling, it blends into the background noise of everyday internet activity. Traditional network monitoring tools that look for known-bad domains or unusual protocols may simply not flag it.

This is a form of "living off trusted infrastructure," a variation on the well-known "living off the land" tactic where attackers use built-in system tools rather than custom malware. Here, the trusted infrastructure isn't a system binary, it's the browser itself and the cloud services it commonly talks to.

Why This Matters for Businesses and Consumers

Ransomware groups like Chaos don't just encrypt files; they often exfiltrate sensitive data first, meaning customer records, employee information, and business documents can be stolen before the ransom note ever appears. When a technique like msaRAT allows attackers to communicate covertly for longer periods without detection, it increases the window of opportunity for data theft and lateral movement across a network.

For consumers, the risk is indirect but real. If a company you do business with is compromised by Chaos ransomware and its browser-based C2 channel goes undetected for weeks, your personal data could be quietly siphoned out before anyone notices. This is part of a broader trend in ransomware operations: attackers are increasingly investing in evasion techniques that exploit trust in everyday cloud services, rather than building obviously malicious infrastructure that's easy to blacklist.

What This Means For You

If you're an IT administrator or security professional, this development is a reminder that headless browser processes running without a visible window deserve scrutiny. Unexpected Chrome or Edge processes spawned by scripts, scheduled tasks, or unfamiliar parent processes are worth investigating, especially if they're communicating with CDP debugging ports or generating unusual WebRTC-style traffic.

For everyday users and small business owners without a dedicated security team, the practical takeaway is less about the specific malware and more about layered defense. Keep browsers and operating systems patched, restrict administrative privileges, and be cautious about the endpoint tools your organization relies on to detect anomalies. Segmenting sensitive traffic and monitoring outbound connections, including through a reputable VPN or network security service, can add a layer of visibility that helps catch unusual patterns even when malware tries to blend in with legitimate cloud traffic.

Actionable Takeaways

  • Monitor for unexpected headless Chrome or Edge processes, particularly those using remote debugging ports associated with CDP.
  • Keep browsers, operating systems, and endpoint detection tools updated to catch known indicators tied to Chaos ransomware and msaRAT.
  • Restrict outbound traffic where possible and review logs for anomalous WebRTC or TURN relay connections that don't match expected business use.
  • Educate IT teams on this evolving technique so alerts aren't dismissed simply because traffic appears to originate from trusted services like Cloudflare or Twilio.

As ransomware groups continue refining how they hide, staying informed about techniques like the one used in this Chaos ransomware campaign is one of the best defenses available. Awareness, paired with basic hygiene like patching and traffic monitoring, remains the most reliable way to reduce your exposure to these evolving threats.