Chaos Ransomware's New RAT Doesn't Phone Home. It Opens Chrome and Lets Chrome Do It.
- Patrick Duggan
- 2 hours ago
- 3 min read
Cisco Talos published a piece of malware this week that is worth understanding even if you never see it, because it is the cleanest example yet of an attack pattern we have been tracking all year: the one where the attacker wins by removing the thing your defenses are watching for. Talos calls the tool msaRAT, a Rust remote-access trojan they attribute to the Chaos ransomware-as-a-service crew. (Note the name collision: this is the actual Chaos RaaS, not the Iranian espionage op that wore a "Chaos" costume earlier this year — different thing entirely.)
Here is what makes it clever. Most remote-access trojans open a network connection to a command-and-control server. That connection is the thing your firewall, your proxy, and your network detection are all built to catch. msaRAT does not open one. Instead, it starts its own copy of Chrome or Edge — a real, signed, legitimate browser — and drives it through the Chrome DevTools Protocol, the debugging interface built into every Chromium browser. The command-and-control traffic then rides out over WebRTC, through that browser process, to infrastructure that looks entirely ordinary: HTTPS to a Cloudflare developer domain, a STUN request to a Google server, a WebRTC relay through Twilio.
The RAT keeps all of its own traffic on 127.0.0.1 — localhost, never touching the wire. The only thing your network sensors ever see leave the machine is a browser doing what browsers do: a video-call-shaped WebRTC session to a normal cloud provider. That is the subtraction. They deleted the suspicious C2 channel your tools hunt for and replaced it with a trusted process making legitimate-looking traffic. If you are watching the network for the malware's connection, there is nothing there to find.
Which means you have to watch the host, not the wire
The defense against this class does not live on the network, because the network is exactly where the attacker made himself invisible. It lives on the endpoint, in process lineage and file activity:
A browser launched with `--remote-debugging-port` is the signature. No normal user starts Chrome or Edge with the remote-debugging flag. A browser process spawned that way — especially spawned by an MSI installer or some parent process that is not the user's shell — is the tell. Alert on it.
Watch `C:\ProgramData\` for the staging. The delivery chain uses curl.exe and certutil.exe to pull files down into C:\ProgramData\. Those living-off-the-land binaries writing executables to that path is a high-signal event on most workstations.
Flag the HeadlessChrome user-agent. The browser it drives identifies as HeadlessChrome in its HTTP requests. Real users are not browsing your network headless.
Follow the process tree, not the destination. The destinations are Cloudflare, Google, and Twilio — you cannot block those. What you can do is ask why a browser process with no visible window is making WebRTC connections, and who its parent is.
What's in the free feed
Talos did the detection and the analysis — credit is theirs — and they published the indicators. We have pulled the two network indicators into our distributed feed so any defender can block them without a subscription: the delivery server at 172.86.126[.]18 and the Cloudflare Workers signaling relay is-01-ast[.]ols-img-12[.]workers[.]dev. Talos also shipped a ClamAV signature, Win.Downloader.ChaosRaas-10060321-0. If you pull our IP and domain blocklists, the network infrastructure is already covered; the real detection, though, is the host-side process behavior above, because the whole point of this malware is that the network side looks clean.
The point
This is the shape of the modern intrusion and it is not going away: the attacker does not bring a suspicious tool onto your network, he borrows the trust of one that is already there. Last week it was an AI agent running a config file a trusted tool executed. Before that it was malware hiding its command channel in a Microsoft 365 calendar. This week it is a ransomware crew routing C2 through a headless Chrome so it reads as a video call. The lesson is always the same — stop looking only for the bad thing arriving, and start looking for the trusted thing behaving strangely. Catch the substitute, not the missing piece.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.