Chaos Ransomware Uses Headless Browsers as Hidden C2 Tunnels

Cisco Talos details msaRAT, the Rust implant behind Chaos ransomware, which hijacks a compromised Windows host to drive a headless Chrome/Edge instance via the Chrome DevTools Protocol and channel all command-and-control traffic through a WebRTC data channel relayed by Twilio TURN. The malware never creates its own outbound connection; the browser handles the C2 signaling, with traffic appearing as legitimate browser activity and using a Cloudflare Worker for signaling. Delivery is via a Windows MSI that loads msaRAT in memory. No public file hashes were published as of mid-2026, but two network indicators (staging IP and a Worker hostname) are noted.