New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

The cybersecurity landscape faces an escalating threat as a novel backdoor, dubbed msaRAT, has been identified in the arsenal of the Chaos ransomware gang. This sophisticated malware, engineered in Rust, employs an innovative technique to conceal its command-and-control (C2) communications by routing them entirely through common web browsers such as Google Chrome and Microsoft Edge. This method significantly complicates detection efforts, presenting a substantial challenge to traditional network security defenses.

The Threat: msaRAT and its Unique Evasion Tactics

Discovered and analyzed by researchers, msaRAT stands out due to its reliance on the Chrome DevTools Protocol (CDP) to manipulate a headless browser session. A headless browser operates without a graphical user interface, making its activity less conspicuous to an unsuspecting user. By leveraging CDP, the malware establishes an encrypted connection to the attacker’s server, effectively embedding malicious traffic within seemingly legitimate browser communications. This strategic maneuver means that msaRAT never makes a direct, overt connection to its C2 infrastructure, thereby drastically reducing the risk of being flagged by firewalls, intrusion detection systems, or other network-level security tools that primarily look for suspicious direct connections or anomalous traffic patterns.

The choice of Rust for developing msaRAT is also noteworthy. Rust, a modern systems programming language, offers advantages such as memory safety, performance, and concurrency, making it increasingly attractive to malware developers seeking to create robust, efficient, and difficult-to-analyze threats. Its growing adoption in legitimate software development also means that security tools may be less adept at detecting Rust-based malicious executables compared to more traditional languages like C++ or C#.

The Chaos Ransomware Group: A Profile

The Chaos ransomware group, which has been making headlines in the cybersecurity community, emerged recently, with reports in late 2023 detailing its activities. It is important to distinguish this iteration of Chaos from an unrelated ransomware family of the same name that operated since 2021. This newer group quickly garnered attention, with the FBI reportedly seizing $2.4 million in Bitcoin from its operations, underscoring its financial motivations and scale.

Further adding to the complexity of the threat landscape, researchers at Rapid7 earlier this year uncovered a disconcerting link between the Chaos ransomware group and MuddyWater, an Iranian state-backed advanced persistent threat (APT) group. MuddyWater was observed leveraging Chaos ransomware not for financial gain in these specific instances, but as a sophisticated decoy. By deploying financially motivated ransomware, the state-sponsored hackers aimed to disguise their true objective: cyber-espionage operations. This tactic allows APTs to blend in with common criminal activities, muddying the waters for attribution and diverting attention from their strategic intelligence-gathering missions. Such a strategy highlights the evolving convergence of cybercrime and state-sponsored cyber warfare, where tools and techniques are shared or repurposed to achieve diverse malicious goals.

Recent attack campaigns attributed to the Chaos ransomware group, as meticulously documented by the Cisco Talos research team, typically initiate through highly effective social engineering tactics. These often involve email-based phishing or voice phishing (vishing) campaigns designed to trick victims into granting initial access. Once a foothold is established within the target environment, attackers proceed to install legitimate remote management software. This critical step ensures persistence, allowing the attackers to maintain access to the compromised system even after reboots or attempts to remove initial infection vectors. The use of legitimate tools further aids in evading detection, as their activity can be mistaken for routine administrative tasks.

The Infection Chain: From Phishing to Persistence

The deployment of msaRAT within a compromised network follows a structured, multi-stage infection chain designed for stealth and effectiveness. After gaining initial access and establishing persistence, the attacker proceeds to download a seemingly innocuous MSI installer. This installer is cleverly disguised, often masquerading as a routine Windows update. This deception exploits users’ trust in system updates and their typical behavior of allowing such installations, which often bypass certain security checks.

Upon execution, this MSI installer does not directly drop an executable file onto the disk in a readily detectable manner. Instead, it is engineered to load the msaRAT payload, specifically identified as lib.dll, directly into the system memory. This "fileless" or "living off the land" technique is a hallmark of advanced persistent threats. By operating primarily in memory, the malware avoids leaving forensic artifacts on the disk, making post-compromise analysis significantly more challenging and allowing it to evade traditional endpoint detection and response (EDR) solutions that rely heavily on disk-based signatures. The memory-resident nature of msaRAT ensures that it can execute its malicious functions without triggering alarms associated with suspicious file creation or modification.

Technical Deep Dive: Browser Hijacking and C2 Establishment

The core innovation of msaRAT lies in its sophisticated browser hijacking mechanism. Once launched in memory, msaRAT systematically searches for installed web browsers, prioritizing Google Chrome or Microsoft Edge. It then initiates the selected browser in a "headless" mode. This headless operation means the browser process starts and functions in the background without displaying any visible window or user interface elements. From a user’s perspective, no browser application appears to be open, making the malicious activity completely invisible.

Following the launch of the headless browser, msaRAT activates the browser’s remote debugging interface. This interface, normally used by developers to inspect and debug web applications, becomes the malware’s control point. msaRAT connects to this interface using the Chrome DevTools Protocol (CDP). CDP is a powerful, low-level API that allows external tools to inspect, debug, and profile Chromium-based browsers. By leveraging CDP, msaRAT gains full programmatic control over the browser’s functionalities.

The next critical step involves opening a new, equally invisible, browser tab. Into this tab, msaRAT injects custom JavaScript code using CDP commands. This injected JavaScript is meticulously crafted to perform several crucial functions:

1. Building the Communication Channel: It lays the groundwork for the secure C2 communication.
2. Bypassing Content Security Policy (CSP): Content Security Policy is a browser security feature designed to prevent cross-site scripting (XSS) and other code injection attacks by specifying which dynamic resources are allowed to load. msaRAT’s injected JavaScript includes mechanisms to circumvent or neutralize the browser’s CSP, ensuring its malicious code can execute without hindrance and communicate externally.
3. Registering CDP Bindings: It establishes specific bindings within CDP that facilitate the subsequent encrypted communications with the attacker’s infrastructure.

Once this intricate initial setup is complete, the compromised browser, under msaRAT’s control, initiates contact with a Cloudflare Workers endpoint (specifically, is-01-ast[.]ols-img-12[.]workers[.]dev). Cloudflare Workers are serverless execution environments that allow developers to run JavaScript code at Cloudflare’s edge network, close to users. In this context, the Cloudflare Workers endpoint serves as a crucial signaling relay. Its primary role is to provide the WebRTC connection information necessary for establishing a robust and encrypted channel.

WebRTC (Web Real-Time Communication) is a collection of APIs and protocols that enables real-time communication between browsers and mobile applications. msaRAT exploits WebRTC’s capabilities to create its secure C2 tunnel. The communication established through this mechanism benefits from two distinct layers of encryption:

1. WebRTC DTLS (Datagram Transport Layer Security): This layer is automatically provided by the browser’s inherent WebRTC implementation, securing the transport of data.
2. ChaCha20-Poly1305 + ECDH Key Exchange: Implemented directly by msaRAT, this is a strong, modern cryptographic suite that adds a second, application-level layer of encryption. ChaCha20-Poly1305 is an authenticated encryption algorithm, offering both confidentiality and integrity, while Elliptic Curve Diffie-Hellman (ECDH) ensures secure key exchange. This dual-layer encryption significantly enhances the confidentiality and integrity of the C2 communications, making them exceptionally difficult to intercept and decrypt.

Double-Layered Evasion: Cloudflare Workers and Twilio TURN

The design of msaRAT’s communication scheme demonstrates a profound understanding of network infrastructure and evasion techniques. Beyond the Cloudflare Workers signaling, communication is further relayed through Twilio TURN (Traversal Using Relays around NAT) servers. TURN servers are legitimate network components used in WebRTC to facilitate communication between peers that are behind Network Address Translators (NATs) or firewalls, acting as relays when a direct peer-to-peer connection is not possible.

Crucially, Cisco Talos researchers observed that msaRAT intentionally omits the Interactive Connectivity Establishment (ICE) candidates that are typically present in standard WebRTC communications. ICE is a framework that allows WebRTC to find the best possible path for two peers to connect, often prioritizing direct P2P connections. By deliberately excluding these candidates, msaRAT forces all communications to be routed exclusively through TURN servers. This design decision serves a critical evasion purpose: it prevents direct peer-to-peer connections from ever being established.

The implications of this forced relay through Twilio’s legitimate service are profound for threat detection. As Cisco Talos elucidates, "By routing traffic through Twilio’s legitimate service, the real IP address of the attacker’s server never appears in the network traffic, and the dual-layer infrastructure combining Twilio with Cloudflare Workers makes it significantly difficult to trace the attacker’s infrastructure." This means that network defenders attempting to trace the origin of suspicious traffic will only see connections to Twilio’s legitimate, high-reputation IP addresses, effectively masking the actual C2 server’s location.

The use of Cloudflare Workers as the initial signaling relay further bolsters the attacker’s anonymity and resilience. Cloudflare’s infrastructure acts as a protective shield, assigning its own IP addresses to the worker endpoints. Consequently, any network traffic analysis or firewall logs will show connections to Cloudflare IPs, which are generally trusted and whitelisted. Blocking an entire Cloudflare IP range or the *workers.dev free subdomain (which is assigned to developers) would be impractical for most organizations, as it would disrupt legitimate Cloudflare Workers deployments and affect numerous benign services. This creates a significant dilemma for network defenders, forcing them to choose between blocking essential services or allowing potentially malicious traffic.

The Data Exchange Protocol: Frames and Commands

Cisco Talos meticulously documented the data exchange system employed by msaRAT, breaking down the communication into discrete units called "frames." These frames are the fundamental building blocks of the C2 communication, each serving a specific purpose within the malicious operation. Examples of documented frames include:

• Key Exchanges: Used to establish and refresh the cryptographic keys for the dual-layered encryption.
• Channel Opening/Closing: Commands to initiate or terminate communication channels for specific tasks.
• Session Resets: Mechanisms to reset the communication session, possibly to clear state or evade detection.
• Windows Command Execution: The most critical frames, allowing the attackers to issue arbitrary commands to the compromised Windows system, enabling data exfiltration, further malware deployment, or system manipulation.

This granular control over communication, encapsulated within encrypted frames and relayed through legitimate services, allows msaRAT to execute a wide range of post-exploitation activities without ever directly exposing the attacker’s true infrastructure.

Expert Perspectives and Broader Implications

Cybersecurity analysts universally agree that msaRAT represents a significant evolution in C2 evasion techniques. The integration of headless browsers, CDP, WebRTC, and legitimate cloud services like Cloudflare Workers and Twilio TURN marks a new level of sophistication. Industry experts emphasize that this approach makes traditional signature-based network detection tools largely ineffective. "When C2 traffic is indistinguishable from normal web browsing, it essentially renders perimeter defenses blind," notes one prominent security researcher. "Organizations must shift their focus to advanced endpoint detection, behavioral analytics, and robust threat intelligence to combat such stealthy threats."

The implications extend beyond just network security. Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) solutions must become more adept at identifying anomalous browser behavior, even in headless mode. This includes monitoring for unusual CDP activity, unexpected WebRTC connections, and JavaScript injection within legitimate browser processes. The blurring lines between legitimate and malicious traffic necessitates a deeper, context-aware analysis of all network activity.

Mitigation Strategies and Recommendations

Combating sophisticated threats like msaRAT requires a multi-layered and proactive security posture. Organizations should consider the following mitigation strategies:

1. Enhanced Endpoint Security: Implement advanced EDR/XDR solutions capable of behavioral analysis to detect unusual process execution, memory injection, and browser manipulation, even if it mimics legitimate activity. Focus on solutions that can monitor and alert on CDP usage by non-developer tools.
2. Network Segmentation and Micro-segmentation: Isolate critical assets and systems to limit the lateral movement of attackers once initial access is gained. Even if msaRAT establishes a C2 channel, robust segmentation can prevent it from reaching high-value targets.
3. Browser Hardening and Management: Enforce strict browser security policies. While blocking CDP entirely might be impractical for developers, monitoring its usage and restricting its capabilities for non-privileged users or applications can be beneficial. Regular patching and updates for browsers are also essential.
4. User Education and Awareness Training: Since initial access often relies on phishing, continuous training for employees on identifying and reporting suspicious emails, links, and vishing attempts is paramount.
5. Proactive Threat Hunting: Security teams should actively hunt for indicators of compromise (IoCs) provided by threat intelligence reports (like those from Cisco Talos). This includes scanning for specific domain names (e.g., is-01-ast[.]ols-img-12[.]workers[.]dev), unusual WebRTC traffic patterns, and the presence of msaRAT artifacts in memory.
6. Zero Trust Architecture: Adopt a Zero Trust model, which mandates strict identity verification for every user and device attempting to access resources, regardless of whether they are inside or outside the network perimeter. This minimizes the impact of a compromised endpoint.
7. Deep Packet Inspection and TLS/SSL Decryption: While challenging due to encryption, deep packet inspection, where legally and technically feasible, could potentially identify anomalous patterns within encrypted traffic, even if the destination is a legitimate cloud service.
8. Regular Security Audits and Penetration Testing: Periodically assess the effectiveness of existing security controls against the latest threat vectors to identify and remediate weaknesses.

The comprehensive list of indicators of compromise (IoCs) associated with msaRAT backdoor attacks, shared by Cisco Talos (available on their GitHub repository), is an invaluable resource for organizations to bolster their defenses and enhance detection capabilities.

Conclusion

The emergence of msaRAT, leveraging sophisticated browser-based C2 communication and legitimate cloud services, underscores the relentless innovation of malicious actors. The Chaos ransomware group, potentially operating with state-sponsored backing in some instances, is employing tactics that directly challenge the efficacy of traditional cybersecurity defenses. As threats continue to evolve, blending seamlessly with legitimate network traffic, the cybersecurity industry must adapt by embracing advanced behavioral analytics, robust endpoint security, proactive threat intelligence, and a holistic, multi-layered defense strategy. The fight against such stealthy malware demands constant vigilance and a continuous re-evaluation of security paradigms.