Overview
- Cisco Talos published its analysis on Thursday, July 23, 2026, naming msaRAT a Rust remote‑access trojan used by the Chaos ransomware group that drives a headless Chrome or Edge process to carry command‑and‑control traffic.
- The malware keeps its own process confined to 127.0.0.1 and uses the Chrome DevTools Protocol to inject JavaScript that signals a Cloudflare Workers endpoint and opens a WebRTC data channel relayed through Twilio TURN.
- msaRAT wraps WebRTC’s DTLS with a second ChaCha20‑Poly1305/ECDH encryption layer so C2 payloads are double encrypted and the attacker’s server IP never appears in packet captures.
- Talos says the implant arrived post‑compromise in observed cases via a curl download of an MSI that loads a DLL into memory; defenders should hunt for MSI activity in ProgramData and browser processes started with headless and remote‑debugging flags.
- Talos released IoCs, a ClamAV signature and Snort rules but left key operational details unresolved, and security teams face a tradeoff because blocking Workers or Twilio will break legitimate services while detection must focus on host behavior.