GoKawiilThe Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers.
The malware is written in Rust and uses the Chrome DevTools Protocol (CDP) to control a headless browser session and establish a connection to the attacker's server.
Since the malware routes all communication through the browser, it does not make any direct connection to the C2 infrastructure, significantly lowering the risk of detection.
The Chaos ransomware group emerged in early 2025, unrelated to the same-named ransomware family that existed since 2021.
Earlier this year, researchers at Rapid7 found that Chaos was leveraged by Iranian state-backed hackers ‘MuddyWater’ to disguise their cyber-espionage operations as financially motivated attacks.
More recent Chaos ransomware attacks observed by the Cisco Talos research team started through email or voice phishing and continued with the installation of remote management software to establish persistence.
Once inside the environment, the attacker downloaded an MSI installer posing as a Windows update, which loads msaRAT (lib.dll) directly in system memory.
Infection chain
Source: Cisco Talos
Hijacking Chrome
... continue reading