Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Summary
The Chaos ransomware group is utilizing a Rust implant called msaRAT to route its command-and-control (C2) traffic through the victim's own web browsers. This technique involves running Chrome or Edge in headless mode, allowing the implant to communicate locally via 127.0.0.1 without establishing direct outbound connections.
IFF Assessment
This technique allows malware to obfuscate its command and control traffic, making it harder for defenders to detect and block.
Defender Context
Defenders should be aware of techniques that leverage legitimate browser processes for malicious C2 communication. Monitoring for unusual browser activity, particularly headless instances communicating locally, and endpoint detection and response (EDR) solutions capable of analyzing process behavior are crucial.