#6
The Hacker News
general
July 23, 2026 at 13:11 UTC
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
By [email protected] (The Hacker News)
AI Summary
Cisco Talos detailed msaRAT, a Rust-based implant deployed by the Chaos ransomware group as a precursor to encryption, which routes all C2 traffic through the victim's own Chrome or Edge browser running in headless mode via localhost (127.0.0.1). This technique makes outbound C2 traffic indistinguishable from normal browser activity, effectively defeating network-layer detection tools that flag anomalous outbound connections. The implant was found on a compromised Windows machine ahead of the ransomware encryptor stage.
Relevance score: 80.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →