Chaos ransomware deploys browser‑based msaRAT that tunnels C2 through Chrome/Edge, evading network detection
What Happened — Cisco Talos identified a new Rust‑based remote‑access trojan (msaRAT) used by the Chaos ransomware group. The RAT never makes a direct network connection; instead it routes all command‑and‑control traffic through the victim’s Chrome or Edge browser via the Chrome DevTools Protocol and WebRTC. Because the traffic appears as legitimate HTTPS and WebRTC flows, traditional network‑based detections miss the malicious activity.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how attackers can bypass perimeter controls, highlighting the need for SOC 2‑aligned access‑control monitoring that captures anomalous use of privileged browser debugging interfaces.
- Provides a concrete example of why continuous evidence collection (e.g., logging of CDP/WebRTC sessions) is essential to prove the effectiveness of your “restrict privileged access” and “monitor network traffic” controls during an audit.
- Shows that relying solely on port‑based firewalls is insufficient; a SOC 2‑ready program must include deep‑packet inspection and behavior‑based alerts as part of the “detect and respond” control set.
Who Is Affected – Organizations that allow browsers on workstations or servers, especially in technology, financial services, and other sectors with strict SOC 2 requirements.
Recommended Actions
- Enforce least‑privilege for browser debugging ports (disable remote debugging by default).
- Deploy endpoint detection that flags processes launching Chrome/Edge in headless mode with remote‑debugging flags.
- Add deep‑packet inspection or proxying for WebRTC and CDP traffic to surface hidden C2 channels.
- Update your SOC 2 access‑control policies to include “monitor privileged browser APIs” and retain logs as audit evidence.
- Conduct a tabletop exercise to test detection of browser‑based C2 in a ransomware scenario.
Source: Security Affairs
Technical Notes – The attacker first downloads an MSI masquerading as a Windows update, loads the RAT DLL in memory, then hijacks Chrome/Edge via the Chrome DevTools Protocol. C2 is relayed through a Cloudflare Workers endpoint and subsequently over a WebRTC DataChannel to Twilio’s relay service. No direct outbound connections from the malicious binary are observed.