Chaos Ransomware Hides C2 Traffic Inside Headless Browsers

The Chaos ransomware group has adopted a novel technique to conceal its command-and-control communications, routing traffic through the victim's own Chrome or Edge browser using a Rust-based implant dubbed msaRAT. According to Cisco Talos researchers who analyzed the malware found on a compromised Windows machine, the implant never opens an outbound network connection of its own. Instead, it communicates exclusively with 127.0.0.1, then launches a headless browser and drives it through the Chrome DevTools Protocol (CDP), the browser's native debugging API. The result is that every C2 message travels out as what appears to be ordinary browser traffic to Cloudflare and Twilio, with the attacker's server address never appearing on the wire.

msaRAT locates Chrome or Edge through environment variables first, falling back to the Windows registry if needed. It starts the browser without a visible window using the --headless=new flag, enables remote debugging with --remote-debugging-port, and supplies a custom --user-data-dir to bypass a Chrome 136 restriction that disables debugging against the default profile. The malware queries /json/list/ for a debuggable target, opens a WebSocket, disables Content Security Policy with Page.setBypassCSP, and uses Runtime.evaluate to inject JavaScript stored in plaintext within the binary's .rdata section. The injected script fetches STUN and TURN configuration from a Cloudflare Worker at is-01-ast[.]ols-img-12[.]workers[.]dev, with Origin and Referer headers spoofed to look like Microsoft traffic. The resulting WebRTC peer connection is forced through Twilio's global.turn.twilio.com relay, since the returned SDP contains no ICE candidates and a 0.0.0.0 connection address, preventing any direct peer-to-peer link. Operators looking to assess whether their own browsers leak identifying data in similar scenarios can run a browser fingerprint test or check outbound routing with a DNS leak test.

Once the data channel is established, the Cloudflare Worker drops out and traffic flows directly through Twilio's relay. The channel applies two layers of encryption: DTLS at the browser level and a ChaCha-Poly1305-based scheme inside it, keyed by an ECDH exchange that begins with a 0xFE handshake frame from the C2 immediately after connection. Command frames are handed to cmd.exe /e:ON /v:OFF /d /c for execution, while Talos assessed the send queue and flow control as designed to reliably move larger payloads such as screenshots and exfiltrated files. Neither WebRTC-based tunneling nor TURN relay abuse is new on its own, but combining them with CDP-driven browser automation gives defenders a much harder signal to detect, since the outbound traffic blends in with legitimate conferencing and CDN activity. Defenders investigating suspicious browser processes or unfamiliar relay destinations should validate their network paths with a VPN and proxy detector to confirm whether observed endpoints match expected corporate infrastructure.