Back Feeds.4Sysops

Chaos ransomware uses browser

Feeds.4Sysops •IT News • July 23, 2026

The Chaos ransomware group has deployed a new Rust-based remote access trojan, msaRAT, which disguises command-and-control traffic by routing it through legitimate web browsers. By launching Chrome or Microsoft Edge in headless mode with remote debugging enabled, the malware utilizes the Chrome DevTools Protocol to manage communications. This design ensures that all external network activity appears to originate from standard browser processes rather than malicious infrastructure. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chaos Ransomware Deploys msaRAT to Evade Detection via Browsers The Chaos ransomware group has introduced a new Rust-based remote access trojan (RAT) named msaRAT, which disguises command-and-control (C2) traffic through legitimate web browsers like Chrome and Microsoft Edge. By utilizing the Chrome DevTools Protocol, msaRAT can manage communications while appearing as standard browser activity, thus evading network detection. The malware is executed after an initial compromise, typically through phishing methods such as spam emails or vishing. Once installed, msaRAT establishes a covert C2 channel, allowing attackers to send commands and exfiltrate data without raising alarms. This new tactic highlights the evolving sophistication of ransomware groups in leveraging existing software to mask malicious activities. Cisco Talos has confirmed the existence of this RAT and provided details on its operation and capabilities. 8 sources 70

Extracted Entities

Chaos ransomware uses browser

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Ransomware Groups (1)

Tools (1)