Overview
- Cisco Talos published an analysis Thursday that links a new Rust remote access trojan named msaRAT to the Chaos ransomware group and released indicators and a ClamAV signature.
- Operators deliver the malware with a curl.exe download of an MSI that poses as a Windows update, places the installer in ProgramData, and loads the RAT DLL directly into memory during installation.
- msaRAT launches a fresh headless Chrome or Edge process, opens the browser’s remote debugging port, injects JavaScript via the Chrome DevTools Protocol, and establishes a WebRTC channel for command-and-control.
- Signaling and NAT discovery use Cloudflare Workers and Google STUN and the session forces media through Twilio TURN relays so the attacker IP never appears in captures, while msaRAT also applies a second layer of payload encryption and sends commands to cmd.exe for execution.
- Talos warns that network inspection is limited and recommends host-based detection of a browser started with a remote debugging port and attacker-specified user-data directory, and notes the technique could spread because Chaos operates a ransomware-as-a-service model.