msaRAT: Detecting Chaos Ransomware's Browser-Based C2 Evasion

Cisco Talos recently disclosed a concerning evolution in adversary tactics: the emergence of msaRAT, a Rust-based Remote Access Trojan (RAT) attributed to the Chaos ransomware group. What sets msaRAT apart is its ability to evade traditional network detection by routing its entire Command and Control (C2) channel through the victim's installed web browser—specifically Google Chrome or Microsoft Edge—using the Chrome DevTools Protocol (CDP).

For defenders, this represents a significant shift. Standard network anomaly detection often relies on identifying malicious processes communicating over the network. By leveraging a trusted, signed browser binary, msaRAT bypasses these controls. Security teams must immediately adjust their detection logic to focus on process lineage and the abuse of developer tools in production environments.

Technical Analysis

Attribution and Payload: msaRAT is linked to the "Chaos" encryption-based cyber incident group. The malware is written in Rust, offering obfuscation benefits and cross-platform potential, though current reporting focuses on its impact on Windows environments where Chrome and Edge are prevalent.

The Attack Chain:

Initial Execution: The Rust payload is executed on the victim machine.
Process Injection/Hijacking: msaRAT locates the victim's browser installation. It launches the browser (e.g., chrome.exe) or attaches to an existing process with specific arguments intended for remote debugging.
C2 Tunneling: Instead of opening a raw socket or using a custom user-agent, the malware utilizes the Chrome DevTools Protocol (CDP). It effectively turns the browser into a proxy, sending traffic to the attacker's server via WebSockets initiated by the browser process.

Evasion Techniques:

Trusted Binary: Network traffic originates from chrome.exe or msedge.exe. Firewalls and proxies configured to allow browser traffic will likely pass the C2 communications without inspection.
WebSockets: C2 traffic is encapsulated in WebSocket protocols, which can bypass standard HTTP/HTTPS inspection tools that do not fully inspect payload contents within encrypted tunnels.

Affected Systems:

Windows endpoints running Google Chrome or Microsoft Edge.
Environments where browsers are not strictly locked down or where developer tools are permitted.

Detection & Response

Detecting msaRAT requires looking for the abnormal usage of browser debugging features. Standard users rarely launch Chrome or Edge with remote debugging enabled. The following rules and queries are designed to identify this specific behavior.

SIGMA Rules

YAML

---
title: Potential Browser-Based RAT C2 via Remote Debugging
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects Chrome or Edge launched with remote debugging ports, a tactic used by msaRAT to tunnel C2 traffic.
references:
  - https://securityaffairs.com/195876/malware/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
    CommandLine|contains: '--remote-debugging-port'
  condition: selection
falsepositives:
  - Legitimate developer activity (verify with user)
level: high
---
title: Suspicious Parent Spawning Browser with Network Capability
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Chrome or Edge spawned by a suspicious parent process (e.g., script, unsigned binary) indicative of malware hijacking the browser.
references:
  - https://securityaffairs.com/195876/malware/chaos-ransomware-deploys-browser-based-msarat-to-evade-network-detection.html
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_parent:
    ParentImage|endswith:
      - '.exe'
    ParentImage|notcontains:
      - '\Program Files\'
      - '\Program Files (x86)\'
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  filter_legit:
    ParentImage|contains:
      - '\explorer.exe'
  condition: selection_img and selection_parent and not filter_legit
falsepositives:
  - Custom launchers or non-standard browser installations
level: medium

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for Chrome/Edge processes with remote debugging arguments
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("chrome.exe", "msedge.exe")
| where ProcessCommandLine has "--remote-debugging-port"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for browser processes using Chrome DevTools Protocol (CDP)
SELECT Pid, Name, Exe, Cmdline, Username, StartTime
FROM pslist()
WHERE Name =~ "chrome.exe" OR Name =~ "msedge.exe"
  AND Cmdline =~ "--remote-debugging-port"

Remediation Script (PowerShell)

PowerShell

<#
.SYNOPSIS
    Detect and terminate suspicious browser instances used for C2 tunneling.
.DESCRIPTION
    This script scans for Chrome and Edge processes running with remote debugging
    ports enabled—a key indicator of msaRAT activity—and kills the process tree.
#>

Write-Host "Scanning for suspicious browser processes..." -ForegroundColor Cyan

$targetProcesses = @("chrome.exe", "msedge.exe")
$suspiciousFlag = "--remote-debugging-port"

foreach ($proc in Get-Process | Where-Object { $targetProcesses -contains $_.ProcessName }) {
    try {
        $cmdLine = (Get-CimInstance Win32_Process -Filter "ProcessId = $($proc.Id)").CommandLine
        if ($cmdLine -and $cmdLine.Contains($suspiciousFlag)) {
            Write-Host "[ALERT] Suspicious process found: $($proc.ProcessName) (PID: $($proc.Id))" -ForegroundColor Red
            Write-Host "Command Line: $cmdLine" -ForegroundColor Yellow
            
            # Stop the process tree
            Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
            Write-Host "Process terminated." -ForegroundColor Green
            
            # Log to Event Log for SOC correlation
            Write-EventLog -LogName "Security" -Source "SecurityArsenal" -EntryType Warning -EventId 1337 -Message "Suspicious browser process with remote debugging flag terminated: $cmdLine"
        }
    }
    catch {
        # Access denied or process terminated during check
    }
}

Write-Host "Scan complete."

Remediation

Immediate Actions:

Isolate Affected Hosts: If msaRAT is detected, isolate the endpoint from the network immediately to prevent C2 communication, even if it is tunneling through the browser.
Terminate Malicious Processes: Use the provided PowerShell script or EDR response capabilities to kill the browser instances and the parent Rust payload.
Block Ports: If your organization does not require remote debugging, block outbound traffic on ports commonly used for CDP (default is 9222) at the firewall for non-developer segments.

Long-Term Hardening:

Application Control: Implement strict allow-listing (e.g., AppLocker) to prevent the execution of unsigned Rust binaries or the spawning of browsers from non-standard parent processes.
Browser Policies: Utilize Group Policy or Enterprise Browser management to restrict the use of the --remote-debugging-port switch. Chrome Enterprise policies can prevent remote debugging on end-user machines.
Network Traffic Analysis: Deploy SSL/TLS inspection capable of inspecting WebSocket traffic to identify anomalies within the browser tunnel, although this is resource-intensive.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub