Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
The Chaos ransomware group is utilizing a sophisticated technique involving msaRAT, a Rust-based implant, to establish a command-and-control channel. msaRAT leverages a headless Chrome or Edge browser, communicating through the browser's debugging API (CDP) and a WebRTC data channel relayed by Twilio's TURN service, effectively hiding the C2 traffic behind legitimate browser activity. This allows the malware to execute commands and deliver payloads, bypassing traditional security measures. The group employs a standard playbook of spam floods and vishing, and the delivery is a simple curl download disguised as a Windows update.
The Chaos ransomware group is leveraging a sophisticated technique involving msaRAT, a Rust-based implant, to establish a command-and-control channel. msaRAT leverages a headless Chrome or Edge browser, communicating through the browser's debugging API (CDP) and a WebRTC data channel relayed by Twilio's TURN service, effectively hiding the C2 traffic behind legitimate browser activity. This allows the malware to execute commands and deliver payloads, bypassing traditional security measures. The group employs a standard playbook of spam floods and vishing, and the delivery is a simple curl download disguised as a Windows update.
What happened
The Chaos ransomware group is utilizing msaRAT to establish a C2 channel, bypassing traditional security measures. msaRAT uses a headless Chrome or Edge browser, communicating through CDP and a WebRTC data channel relayed by Twilio's TURN service. The implant never opens an outbound connection of its own, talking only to 127.0.0.1. It starts Chrome or Edge in headless mode and drives the browser over the Chrome DevTools Protocol (CDP).
Technical details
- **msaRAT:** A Rust-based implant, written on the Tokio async runtime.
- **Browser Dependency:** Requires either Chrome or Edge to be present and allowed to communicate outbound.
- **CDP Communication:** Uses the browser's debugging API (CDP) for communication.
- **WebRTC Relay:** Leverages Twilio's TURN service for WebRTC data channel relaying.
- **Cloudflare Worker:** Utilizes a Cloudflare Worker at is-01-ast[.]ols-img-12[.]workers[.]dev for signaling.
- **Delivery Method:** A simple curl download disguised as a Windows update.
- **Detection Coverage:**
- ClamAV: Win.Downloader.ChaosRaas-10060321-0
- Snort 2: 1:66839,1:66840,1:66841
- Snort 3: 1:66839,1:301587
Impact
The malware's C2 channel is hidden behind legitimate browser traffic, making it difficult to detect and block. The group's playbook of spam floods and vishing indicates a broad targeting strategy. The report does not identify the victim, establish how many organizations received msaRAT, say when the malware entered use, or explain how the Cloudflare Worker and Twilio TURN credentials were obtained. The use of a shared deployment domain (workers.dev) by Cloudflare adds a layer of complexity for defenders.
What to do
- **Block Twilio TURN:** Block either at the organization level to prevent C2 traffic from utilizing Twilio's relay service.
- **Monitor Headless Browser Activity:** Hunt for Chrome or Edge launched by an installer, a service, or another non-interactive parent with --headless=new and --remote-debugging-port set.
- **Correlate Processes:** Correlate headless browser processes with loopback traffic to the debugging port and outbound WebRTC.
- **Treat as Tradecraft:** Consider this as observed tradecraft rather than a measured campaign, as indicators can change quickly.
Why it matters
The use of a headless browser and a relay service like Twilio's TURN significantly increases the difficulty of detecting and blocking the C2 channel. The report highlights a sophisticated tactic employed by the Chaos ransomware group, emphasizing the need for proactive monitoring and a layered security approach to mitigate the risk of compromise.