Chaos ransomware group deploys msaRAT malware that routes C2 via Chrome and Edge browsers
What Happened — The Chaos ransomware gang released a new Rust‑based backdoor, msaRAT, that hides its command‑and‑control traffic by leveraging the Chrome DevTools Protocol (CDP) to run a headless Chrome or Edge instance. All C2 communication is tunneled through legitimate Cloudflare Workers and Twilio TURN servers, making network detection extremely difficult.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a control gap where legitimate browser processes can be subverted for malicious traffic, challenging the effectiveness of network‑monitoring and intrusion‑detection controls required by SOC 2 CC6.
- Highlights the need for continuous evidence collection on privileged process usage and third‑party service interactions to satisfy audit‑ready logs.
- Aligns with Verisq’s Control Mapping capability, which automates mapping of such emerging techniques to existing SOC 2 controls and provides verifiable evidence for auditors.
Who Is Affected – Enterprises across all sectors that rely on Chrome/Edge browsers for daily operations, especially those with remote workforces and cloud‑centric architectures (e.g., technology SaaS, financial services, healthcare).
Recommended Actions
- Map the “use of legitimate services for C2” technique to SOC 2 CC6.1 (Network Monitoring) and CC7.1 (System Operations) controls.
- Deploy endpoint detection that monitors CDP activation and headless‑browser launches, and retain logs for audit evidence.
- Conduct a focused risk assessment on third‑party services (Cloudflare, Twilio) used for outbound traffic and update incident‑response playbooks.
Source: BleepingComputer
Technical Notes – msaRAT uses the Chrome DevTools Protocol to control a headless browser, injects JavaScript that bypasses CSP, and establishes a double‑encrypted channel (WebRTC DTLS + ChaCha20‑Poly1305 + ECDH). Communication is relayed through Twilio TURN servers and a Cloudflare Workers endpoint, obscuring attacker IPs. Source: same article