Full research report

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

msaRAT represents a technically deliberate inversion of the conventional malware network model: rather than building a custom covert channel at the OS or driver layer, it parasitises the victim's installed browser, rendering all C2 traffic indistinguishable from legitimate web browsing at the network perimeter. The intentional omission of WebRTC ICE candidates to force Twilio TURN relay is an architectural decision specifically designed to prevent any peer-to-peer path that could expose the C2 server's IP, and the use of free Cloudflare Workers subdomains for signalling creates a structural dilemma for defenders since blocking *.workers.dev causes broad collateral disruption to legitimate services. The Rapid7-established connection between MuddyWater and the Chaos ransomware brand in May 2026 raises the possibility that msaRAT may appear in state-sponsored intrusions, but Cisco Talos has not confirmed this attribution for the July 2026 campaigns, leaving the actor relationship as a significant analytical gap. Host-level detection — monitoring for headless browser processes spawned with remote debugging flags outside user sessions, particularly following MSI activity in ProgramData — is currently the most reliable and actionable defensive signal available to defenders.

What happened

On 23 July 2026, Cisco Talos published a technical analysis of msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware group in post-compromise operations. The malware hijacks Chrome or Microsoft Edge via Chrome DevTools Protocol (CDP) to route all C2 traffic through WebRTC channels relayed by Cloudflare Workers and Twilio TURN, ensuring the attacker's server IP never appears in network captures. Initial access preceded msaRAT deployment via phishing, with the RAT loaded in-memory through an MSI installer masquerading as a Windows update. Separately, Rapid7 reported in May 2026 that Iranian state-sponsored group MuddyWater had used the Chaos ransomware brand as cover for espionage, contextualising the Chaos group's threat posture but not directly confirmed for these msaRAT-specific deployments.

Affected scope

Windows systems with Chrome or Microsoft Edge installed; post-compromise deployment following phishing-based initial access. Chaos operates as a ransomware-as-a-service (RaaS) platform active since February 2025. Specific victim sectors and organisations have not been publicly disclosed by Cisco Talos.

Technical assessment

msaRAT launches a headless Chrome or Edge instance via CDP with remote debugging enabled, then establishes a WebSocket connection to the browser's debugging interface and injects JavaScript to bypass Content Security Policy and create a WebRTC DataChannel. Signalling is handled through a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev); ICE candidates are deliberately omitted to prevent P2P connections and force all relay traffic through Twilio TURN (global.turn.twilio.com), permanently concealing the C2 server's IP. The RAT process communicates only on 127.0.0.1; all external traffic originates from the browser. Two encryption layers are applied: DTLS provided automatically by WebRTC transport, and application-level ChaCha20-Poly1305 with ECDH key exchange implemented by the RAT.

Recommended defensive actions

  1. Deploy Cisco Talos ClamAV signature Win.Downloader.ChaosRaas-10060321-0 and Snort rules 1:66839, 1:66840, 1:66841 (Snort 2) and 1:301587 (Snort 3)
  2. Monitor endpoint telemetry for Chrome or Edge processes spawned with --remote-debugging-port or custom --user-data-dir arguments from non-user processes, particularly curl.exe or MSI installers executing from C:\ProgramData
  3. Block egress to and alert on IoC IP 172.86.126.18 and Cloudflare Workers domain is-01-ast.ols-img-12.workers.dev
  4. Alert on HeadlessChrome user-agent strings in outbound HTTP/S traffic as a network-observable artefact of the signalling phase
  5. Restrict or alert on curl.exe and certutil.exe downloading MSI files into ProgramData directories via application control policies or SIEM rules

Uncertainties and evidence gaps

  • Cisco Talos's msaRAT report does not directly attribute these deployments to MuddyWater; the Iranian state link derives from Rapid7's separate May 2026 report on a different Chaos campaign using a different RAT (Darkcomp/Game.exe) and has not been confirmed for the July 2026 msaRAT activity
  • Full victim scope, targeted sectors, and total number of affected organisations have not been disclosed
  • Whether additional C2 infrastructure beyond the two published IoCs exists is unknown; the Talos IoC file is sparse
  • The final Chaos ransomware encryptor stage has not been analysed alongside the msaRAT report, leaving the complete kill-chain partially uncharacterised

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessPost-compromise; requires prior foothold obtained through phishing (email or voice) and remote management software installation
ComponentChrome or Microsoft Edge browser process on Windows, controlled via the Chrome DevTools Protocol debugging interface
MechanismA memory-resident DLL hijacks the browser's debugging interface via CDP WebSocket, injects JavaScript to create a WebRTC DataChannel, and deliberately routes all relay traffic through Twilio TURN by omitting ICE candidates, bypassing standard network-layer detection
ImpactPersistent covert C2 channel enabling remote command execution with the attacker's server IP fully concealed behind legitimate cloud relay infrastructure, staged before ransomware encryption
DetectionHeadless Chrome/Edge process spawned with remote-debugging flags by non-user processes; HeadlessChrome user-agent in outbound requests; curl.exe or MSI installer activity in C:\ProgramData; Talos ClamAV signature and Snort rules
MitigationApply Cisco Talos detection signatures; block IoC IP 172.86.126.18 and Cloudflare Workers domain is-01-ast.ols-img-12.workers.dev; enforce application control to restrict headless browser invocations by non-user processes
Exploitation status

Active exploitation confirmed: Cisco Talos observed msaRAT deployed in post-compromise Chaos ransomware operations in July 2026; no public proof-of-concept code found.

Research process

Investigation opened with the two supplied outlet articles to frame the event, then searched for and fetched the Cisco Talos primary blog post as the authoritative technical source. Two independent secondary sources (Help Net Security and Security Affairs) were fetched to corroborate key claims. A targeted search on the Rapid7/MuddyWater connection confirmed it as a separate May 2026 campaign that contextualises the Chaos ecosystem but is not directly attributed to the msaRAT deployments, which is recorded as a material uncertainty. The Talos IoC GitHub file was fetched to confirm the published indicators before inclusion.

  1. What are the core facts in the two supplied outlet articles?
    Fetched BleepingComputer and The Hacker News articles in parallel
    bleepingcomputer.com ↗

    msaRAT is a Rust RAT deployed by the Chaos ransomware group; uses CDP to hijack Chrome/Edge; routes C2 via Cloudflare Workers and Twilio TURN; loaded in-memory via a fake Windows Update MSI; The Hacker News provided the Cisco Talos primary blog URL

    why Established the event outline and surfaced the primary source URL for direct verification

  2. What technical depth does the Cisco Talos primary report add?
    Searched for Cisco Talos msaRAT coverage, then fetched the primary Talos blog post
    blog.talosintelligence.com ↗

    Confirmed Rust/Tokio implementation, CDP WebSocket control, JavaScript injection to bypass CSP, ECDH/ChaCha20-Poly1305 double encryption, deliberate omission of ICE candidates, frame type taxonomy, ClamAV signature, and Snort rules

    why Primary source; all subsequent technical claims are sourced here rather than to secondary reporting

  3. Do independent sources corroborate the Talos findings?
    Fetched Help Net Security and Security Affairs articles
    helpnetsecurity.com ↗

    Help Net Security confirmed dual-layer encryption, host-level detection guidance, and HeadlessChrome user-agent as the key network artefact; Security Affairs independently confirmed the two-relay infrastructure design and delivery chain

    why Two verified independent domains corroborate Talos findings, meeting the minimum evidence threshold for high confidence

  4. What IoCs are published and are they verifiable?
    Fetched the Cisco Talos IoC GitHub file
    github.com ↗

    Two IoCs published: IP 172.86.126.18 and domain is-01-ast.ols-img-12.workers.dev; the file is sparse and may not represent the full infrastructure

    why Confirmed IoCs are real and citable; sparseness is flagged as an uncertainty for defenders

  5. Is the MuddyWater/Iranian state attribution directly applicable to the msaRAT deployments?
    Searched for Rapid7 MuddyWater Chaos ransomware 2026 and fetched Infosecurity Magazine article
    infosecurity-magazine.com ↗

    Rapid7's May 2026 report confirmed MuddyWater used Chaos branding as a false flag for espionage, but deployed a different RAT (Darkcomp/Game.exe), not msaRAT; Cisco Talos's July 2026 report does not independently assert MuddyWater attribution for these deployments

    why The MuddyWater link contextualises the Chaos ecosystem's threat posture but cannot be directly applied to msaRAT without additional evidence; recorded as a material uncertainty

Named in this story
ActorsChaos ransomware group (RaaS platform, active since February 2025)MuddyWater (Iranian state-sponsored APT, linked to Chaos ecosystem by Rapid7 in May 2026)
MalwaremsaRAT (Rust-based remote access trojan)Chaos ransomware encryptor
TargetsWindows systems with Chrome or Edge installed; victim sectors not publicly disclosed

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (3 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok12 records Primary evidence1 matched items Published the source report used to frame and date the event.
Cisco Talosnews ok3 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
The Hacker Newsnews ok10 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1653 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok662 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 6 opened outside the registered collection
References & evidence
Technical references2
github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

github.com/Cisco-Talos/IOCs/blob/main/2026/07/chaos-msarat.txt ↗

Repository captured from the source article as technical context; not validated as PoC or exploit code.

Vendor & gov advisories1
Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel blog.talosintelligence.com ↗

Primary Cisco Talos technical analysis with full IoC list, ClamAV signature, and Snort rules

Analysis & research4
Chaos ransomware msaRAT hides its C2 channel inside a legitimate browser process helpnetsecurity.com ↗

Independent corroboration of Talos findings with defender-focused framing and host-detection guidance

Chaos ransomware deploys browser-based msaRAT to evade network detection securityaffairs.com ↗

Second independent secondary source confirming infection chain, evasion mechanism, and encryption details

Iran-Linked APT Posed as Chaos Ransomware Member in Espionage Campaign infosecurity-magazine.com ↗

Verified reporting on Rapid7's May 2026 attribution of MuddyWater to the Chaos ransomware ecosystem

Cisco-Talos IoC list: chaos-msarat.txt github.com ↗

Official Talos IoC file confirming two published indicators: IP 172.86.126.18 and Cloudflare Workers domain