The Chaos ransomware group has adopted a novel method to conceal its command-and-control (C2) communications by leveraging the victim’s own web browser. This technique involves a Rust-based implant known as msaRAT, which was identified on a compromised Windows system prior to the deployment of the ransomware encryptor.
Unlike traditional malware that establishes direct outbound connections, msaRAT operates exclusively through local communications. It initiates a headless instance of either Google Chrome or Microsoft Edge, utilizing the Chrome DevTools Protocol (CDP) to control the browser. This approach ensures that all C2 traffic is routed through the browser, effectively masking the malicious activity.
To establish this covert channel, msaRAT searches for the presence of Chrome or Edge by checking environment variables and registry entries. If a compatible browser is found, it launches the browser in headless mode with specific command-line arguments, including `–remote-debugging-port` to enable CDP and `–user-data-dir` to specify a separate user profile directory. This setup allows the malware to interact with the browser without displaying a visible window to the user.
Once the browser is operational, msaRAT connects to the CDP endpoint and performs several actions:
- Retrieves a list of debuggable targets and selects an appropriate WebSocket URL.
- Creates a new browser tab and disables the Content Security Policy (CSP) to facilitate unrestricted script execution.
- Registers multiple callbacks through the `Runtime.addBinding` method, including `msaOpen`, `msaClose`, `msaError`, `msaMessage`, and `dataAck`.
- Injects JavaScript code stored within the malware’s binary into the browser’s execution context.
The injected JavaScript fetches Session Traversal Utilities for NAT (STUN) and Traversal Using Relays around NAT (TURN) configuration from a Cloudflare Worker endpoint. It then establishes a WebRTC peer connection, posting a Session Description Protocol (SDP) offer to the same endpoint. The response lacks ICE candidates and sets the connection address to `0.0.0.0`, ensuring that the entire communication channel is relayed through Twilio’s TURN service at `global.turn.twilio.com`. This design obfuscates the C2 server’s address, making detection and analysis more challenging.
Communication over this channel is doubly encrypted: first by the browser’s Datagram Transport Layer Security (DTLS) implementation, and second by a ChaCha-Poly1305 encryption scheme keyed through an Elliptic-curve Diffie–Hellman (ECDH) exchange initiated by the C2 server. This dual-layer encryption enhances the security and stealth of the malware’s communications.
Upon establishing the C2 channel, msaRAT processes incoming command frames by executing them via the Windows Command Prompt (`cmd.exe`). The malware’s design suggests capabilities for handling large payloads, such as file transfers or screenshots, indicating a robust and versatile toolset.
While the individual components of this attack—using WebRTC for C2 channels and controlling browsers via CDP—have been observed separately in previous incidents, the integration of these techniques within a single Rust-based implant represents a significant advancement in evasion tactics. This method effectively disguises malicious traffic as legitimate browser activity, complicating detection efforts.
The initial infection vector for msaRAT remains unspecified. However, the Chaos group’s known tactics include spam campaigns, voice phishing (vishing), exploitation of remote assistance tools like Microsoft Quick Assist, and the use of remote monitoring and management (RMM) tools to establish persistence within targeted networks.
In light of these developments, organizations must enhance their security measures to detect and mitigate such sophisticated evasion techniques. Implementing behavioral analysis tools, monitoring for unusual browser activities, and educating employees about social engineering tactics are crucial steps in defending against these advanced threats.
