🟠 High | Source: The Hacker News
The Chaos ransomware group has deployed a Rust-based implant called msaRAT that routes all command-and-control traffic through the victim’s own browser (Chrome or Edge running in headless mode), communicating only on localhost to evade network detection. Cisco Talos discovered the implant on a compromised Windows host, where it was staged ahead of the ransomware encryptor being deployed. This technique is significant because it abuses trusted, signed browser processes to blend C2 traffic into normal web activity, making it extremely difficult to detect with conventional network monitoring.
Security Architect’s Take: Audit endpoint detection rules to flag headless browser invocations (–headless flags on chrome.exe or msedge.exe) spawned by unexpected parent processes, and ensure EDR policies alert on Rust-based binaries establishing localhost proxy patterns. Review egress controls and DNS logs for anomalous browser-initiated traffic, and consider blocking or restricting headless browser execution on server and non-developer workloads via application control policies.
Original advisory: Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge