The Chaos ransomware gang has quietly shifted its command-and-control (C2) traffic inside every victim’s web browser. Cisco Talos and reporting from BleepingComputer on July 23, 2026 detail msaRAT, a Rust backdoor Chaos operators drop after gaining a foothold, which uses the Chrome DevTools Protocol (CDP) to drive a headless Chrome or Microsoft Edge instance and reach the attacker over WebRTC.
How msaRAT Hides Inside The Browser
Once inside a compromised environment, Chaos operators deliver an MSI installer disguised as a Windows update; it loads lib.dll (msaRAT) directly into memory. The malware then launches Chrome or Edge in headless mode, turns on the browser’s remote-debugging interface and connects to it via CDP. A new tab is opened, JavaScript is injected to build a communications channel, Chrome’s Content Security Policy is bypassed, and several CDP bindings are registered.
The Cloudflare + Twilio Chain
The injected page hits a Cloudflare Workers endpoint (is-01-ast[.]ols-img-12[.]workers[.]dev) to negotiate a WebRTC connection, then relays every subsequent packet through Twilio TURN servers. Traffic is doubly encrypted: WebRTC’s native DTLS plus a ChaCha20-Poly1305 layer over ECDH keys added by msaRAT itself. Talos notes that ICE candidates are deliberately omitted, forcing every session through the TURN relay so the operator’s real IP is never exposed — and blocking workers.dev subdomains outright would disrupt legitimate Cloudflare developer traffic.
Not A Browser Bug — A Trust Bug
msaRAT is post-compromise malware; it does not exploit a Chrome or Edge vulnerability, which means there is no patch to apply against the technique itself. That’s the point: defenders have no obvious signature to hunt beyond an unusual Chrome-launched WebRTC session out of a workstation that has no business hosting one. Chaos itself emerged in early 2025 and, earlier this year, Rapid7 tied Iran’s state-linked MuddyWater actor to Chaos operations used as a cover for espionage.
Response Guidance
Talos published the full IoC set in a Cisco-Talos GitHub repository; enterprises should treat headless-browser processes launched outside their approved developer tool paths as investigation-worthy. The disclosure comes the same day that Check Point patched an actively exploited SmartConsole zero-day, and AegisAI raised $36M for autonomous email defense — a reminder that both sides of the ransomware economy are quickly re-tooling for the agentic era.
Reporting based on coverage from BleepingComputer, Cisco Talos, Help Net Security and The Hacker News.