The Chaos ransomware group has developed a novel method to conceal its malicious activities by leveraging popular web browsers like Google Chrome and Microsoft Edge. Their remote access tool, known as msaRAT, transforms these browsers into covert channels for command execution and data exfiltration, significantly complicating detection efforts.
Initially identified in February 2025, Chaos operates as a ransomware-as-a-service entity, targeting large organizations through double-extortion tactics. Their typical modus operandi involves gaining initial access via phishing emails and voice phishing (vishing) techniques. Once inside, they utilize legitimate remote management tools and file-sharing services to maintain persistence and exfiltrate sensitive data.
Security researchers have linked msaRAT to Chaos through code identifiers such as msaOpen, msaClose, msaError, and msaMessage. This connection is crucial because it reveals how the malware exploits standard browser functionalities to mask its operations. By embedding malicious commands within what appears to be normal browser traffic, msaRAT effectively evades traditional network monitoring tools.
The infection process begins when attackers deploy a Windows installer disguised as a legitimate software update. This installer loads a malicious library directly into the system’s memory, allowing msaRAT to operate without leaving significant traces on the file system—a technique that bypasses many conventional security measures.
Once active, msaRAT searches for installed instances of Chrome or Edge. If found, it launches the browser in headless mode—running without a visible interface—and activates the remote debugging feature intended for developers. Through the Chrome DevTools Protocol, the malware opens a new browser tab and injects JavaScript code. This code contacts a Cloudflare Workers endpoint to establish a WebRTC data channel, a protocol commonly used for real-time communications. By routing this connection through a TURN relay, the attackers obscure their actual server addresses, further enhancing their stealth.
The dual-layer encryption employed—first by WebRTC and then by msaRAT—ensures that the malicious traffic remains concealed within legitimate browser activity. Consequently, security teams monitoring network traffic may only observe standard browser communications, unaware of the underlying malicious operations.
This innovative use of browsers as command channels underscores the evolving sophistication of ransomware tactics. By integrating their operations into everyday applications, attackers can effectively hide in plain sight, making detection and mitigation increasingly challenging. Organizations must enhance their security protocols, focusing on behavioral analysis and anomaly detection to identify such covert activities. Regular updates and patches, combined with comprehensive user education on phishing threats, are essential components of a robust defense strategy against these advanced threats.
