msaRAT: Chaos Ransomware's New Backdoor Hides C2 Traffic Inside Chrome and Edge

Cisco Talos analyzed msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that avoids direct C2 connections by launching headless Chrome/Edge with remote debugging and tunneling commands over WebRTC (relayed via Twilio TURN and Cloudflare), making attacker traffic appear as normal browser activity; the report covers the infection chain (RMM-assisted deployment, MSI loading a DLL in memory), detection challenges, and network/endpoint defensive recommendations.