Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Chaos ransomware uses msaRAT to route C2 traffic via headless Chrome/Edge and Twilio.
The Chaos ransomware group is employing a novel technique to conceal its command-and-control (C2) traffic by routing it through the victim's own web browsers, Chrome or Edge, running in headless mode. This is achieved using a Rust implant called msaRAT, which leverages the Chrome DevTools Protocol and WebRTC data channels relayed by Twilio's TURN service. The traffic is further obfuscated by appearing as legitimate browser activity to Cloudflare and Twilio, making it difficult for defenders to detect the attacker's server.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Twilio?
Get an email when a new story names Twilio, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Chaos ransomware group has developed a sophisticated evasion technique by routing command-and-control traffic through the victim's own Chrome or Edge browsers running in headless mode, using the Chrome DevTools Protocol and WebRTC data channels relayed through Twilio's TURN service. Because the traffic originates from legitimate browser processes and passes through trusted platforms like Cloudflare and Twilio, traditional network-based detection tools struggle to distinguish malicious activity from normal web browsing. This matters because it fundamentally undermines perimeter-based security controls and signature-based detection, requiring defenders to adopt behavioral and process-level monitoring strategies. Organizations that rely solely on network traffic inspection without endpoint-level visibility will have little warning before ransomware payload delivery and encryption begins.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 127.0.0.1
- domain — is-01-ast[.]ols-img-12[.]workers[.]dev
- domain — global.turn.twilio.com
- ip — 172.86.126[.]18
- url — http://172.86.126[.]18:443/update_ms.msi