Chaos ransomware hides its C2 inside your browser
Cisco Talos published research this week documenting msaRAT, a new Rust-based remote access trojan used by the Chaos ransomware group. The finding deserves attention not because it is another piece of commodity malware, but because of one very specific design choice: msaRAT never touches the network directly. Every byte of command-and-control traffic exits through a legitimate browser process, making it invisible to the most common class of network-layer detection tools.
How msaRAT works
When msaRAT is installed on a victim machine, it launches its own headless instance of Chrome or Edge. It then takes control of that browser using Chrome DevTools Protocol, or CDP, which is the same debugging interface browser developers use to inspect pages, run JavaScript, and monitor network requests. The RAT process itself binds only to 127.0.0.1 and makes zero direct external connections.
From the outside, the traffic pattern looks like a browser doing ordinary things. HTTPS to a Cloudflare developer domain. A STUN request to a Google server. A WebRTC session to a Twilio relay. Every one of those connections originates from the browser process, which most security tools treat as legitimate by default. The actual commands and responses from the attacker are carried inside that WebRTC channel.
Why this technique is harder to catch than it looks
Standard network monitoring tools work by correlating outbound connections with their parent process. A new process connecting to an unfamiliar IP on an unusual port raises a flag. msaRAT collapses that detection model: the process making the external connection is Chrome or Edge, not some anonymous executable named svchost32.exe or similar. Destination IPs belong to Cloudflare, Google, and Twilio, which are on virtually every allowlist.
This is a variation of a technique sometimes called Living Off the Browser, analogous to Living Off the Land techniques that abuse legitimate Windows tools like PowerShell, WMI, and certutil. Where LOTL abuses the OS itself, LOTB abuses the browser. Both share the same logic: legitimate, trusted software leaves a smaller footprint in telemetry than attacker-written code.
The attack chain
Talos attributes msaRAT to the Chaos ransomware group. The typical access pattern is email or voice phishing followed by deployment of legitimate remote monitoring and management tools. msaRAT is a post-compromise step: an attacker downloads and executes it after reaching the victim machine, before deploying the ransomware payload. It provides persistent access, covert C2, and a stable presence to observe the environment before encryption begins.
Detection guidance
The most reliable detection paths are behavioral rather than signature-based. Alert on Chrome or Edge processes launched by unusual parent processes, particularly anything in temp directories or user-profile paths not associated with a normal browser shortcut. Alert on CDP port bindings from process trees that do not trace back to a user-initiated browser session. Monitor for WebRTC session establishment from browser instances that have no associated visible window. Talos has published a full IOC set including process artifacts and network signatures.
For organizations running Palo Alto NGFW or Cisco Secure Firewall with application-layer inspection, WebRTC sessions from headless browser processes are distinguishable from normal browser WebRTC. That is the best network-layer detection hook.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss Living Off the Browser detection strategies or ransomware incident response.