Cisco Talos reports that the Chaos ransomware gang is using msaRAT, a Rust-based backdoor that hides command-and-control traffic by routing it through Chrome or Edge via the Chrome DevTools Protocol. By relaying communications through Cloudflare Workers and Twilio TURN, the malware avoids direct connections to attacker infrastructure and makes detection much harder. #Chaos #msaRAT #CiscoTalos #CloudflareWorkers #TwilioTURN
Keypoints
- Chaos ransomware is using a new backdoor called msaRAT.
- msaRAT is written in Rust and controls Chrome or Edge in headless mode.
- The malware uses Chrome DevTools Protocol to inject JavaScript and build its covert channel.
- Its traffic is relayed through Cloudflare Workers and Twilio TURN instead of direct C2 connections.
- Cisco Talos found that this design hides attacker infrastructure and complicates detection.