Chaos ransomware’s msaRAT hides C2 traffic inside legitimate Chrome/Edge browsers
What Happened – Cisco Talos uncovered a Rust‑based remote‑access trojan (named msaRAT) used by the Chaos ransomware‑as‑a‑service group. The RAT launches a headless instance of Chrome or Edge, uses the Chrome DevTools Protocol, and tunnels all command‑and‑control traffic over a WebRTC channel that appears to originate from a legitimate browser process.
Why It Matters for Compliance & Audit Readiness
- The technique subverts traditional network‑perimeter controls, making it essential to have SOC 2‑aligned access‑control monitoring that can detect anomalous use of trusted applications.
- Continuous evidence collection on process‑launch behavior and outbound TLS traffic to cloud services (e.g., Cloudflare, Twilio) satisfies the Security principle of SOC 2 and provides defensible audit artifacts.
- Demonstrates the need for behavior‑based detection and documented response playbooks, which are core controls in a SOC 2‑ready environment.
Who Is Affected – Any organization that allows Windows workstations to run Chrome or Edge, spanning enterprise, SaaS, and managed‑service environments.
Recommended Actions
- Map this technique to SOC 2 Access Control (CC6.1) and Monitoring (CC7.1) requirements; ensure logging of browser process launches and remote‑debugging ports.
- Deploy behavior‑analytics tools that flag headless browser instances and unusual WebRTC traffic to external relays.
- Enforce strict application allow‑lists and network‑level inspection of outbound TLS to non‑business domains.
Source: Help Net Security
Technical Notes – msaRAT is delivered via an MSI masquerading as a Windows update, executed from ProgramData, and loads a malicious DLL in‑memory. It leverages the Chrome DevTools Protocol, WebRTC, and legitimate cloud services (Cloudflare, Google STUN, Twilio) for C2. No CVE is involved; the attack is a novel malware‑based C2 hiding technique. Source: same as above