Chaos Ransomware Hides C2 Traffic in Legitimate Browser Sessions via msaRAT
The Chaos ransomware group has developed a sophisticated evasion technique by routing command-and-control traffic through the victim's own Chrome or Edge browsers running in headless mode, using the Chrome DevTools Protocol and WebRTC data channels relayed through Twilio's TURN service. Because the traffic originates from legitimate browser processes and passes through trusted platforms like Cloudflare and Twilio, traditional network-based detection tools struggle to distinguish malicious activity from normal web browsing. This matters because it fundamentally undermines perimeter-based security controls and signature-based detection, requiring defenders to adopt behavioral and process-level monitoring strategies. Organizations that rely solely on network traffic inspection without endpoint-level visibility will have little warning before ransomware payload delivery and encryption begins.
Tactical Insight
Immediate actions
- Deploy endpoint detection and response (EDR) tools that monitor for anomalous browser process behavior, including headless mode launches initiated by non-user processes.
- Block or alert on outbound WebRTC and DevTools Protocol (port 9222) connections originating from non-standard parent processes.
- Review and restrict which applications are permitted to invoke Chrome or Edge in headless mode via application allowlisting policies.
Detection measures
- Instrument SIEM rules to flag browser processes spawned by unexpected parent executables (e.g., Rust binaries, unknown services).
- Monitor DNS and TURN/STUN relay traffic to known third-party services (Twilio, Cloudflare) for abnormal volume or frequency from endpoints.
- Establish behavioral baselines for browser process network activity to detect deviations indicative of C2 tunneling.
Long-term improvements
- Implement strict network segmentation to limit lateral movement and restrict endpoints from initiating unsolicited outbound connections to relay services.
- Adopt a Zero Trust architecture that continuously validates process identity and context before permitting outbound network communication.
- Conduct regular threat hunting exercises focused on living-off-the-land and browser-abuse techniques to proactively surface novel evasion methods.