Back Feeds2.Feedburner

Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process

Feeds2.Feedburner •Mirko Zorz • July 23, 2026

Cisco Talos has identified a Rust-based remote access trojan it attributes to the Chaos ransomware group, named msaRAT after four of the binding names left in the binary. The tool starts its own instance of Chrome or Edge on the victim machine and controls it through Chrome DevTools Protocol, a debugging interface built into both browsers. The browser then carries the command-and-control traffic over a WebRTC channel. Once installed, the RAT process keeps all of … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chaos Ransomware Deploys msaRAT to Evade Detection via Browsers The Chaos ransomware group has introduced a new Rust-based remote access trojan (RAT) named msaRAT, which disguises command-and-control (C2) traffic through legitimate web browsers like Chrome and Microsoft Edge. By utilizing the Chrome DevTools Protocol, msaRAT can manage communications while appearing as standard browser activity, thus evading network detection. The malware is executed after an initial compromise, typically through phishing methods such as spam emails or vishing. Once installed, msaRAT establishes a covert C2 channel, allowing attackers to send commands and exfiltrate data without raising alarms. This new tactic highlights the evolving sophistication of ransomware groups in leveraging existing software to mask malicious activities. Cisco Talos has confirmed the existence of this RAT and provided details on its operation and capabilities. 8 sources 70

Extracted Entities

Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)

Tools (2)