New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

The report details msaRAT, a Rust backdoor deployed by the Chaos ransomware group that establishes C2 via Chrome/Edge headless sessions controlled through the Chrome DevTools Protocol; it uses Cloudflare Workers for signaling and Twilio TURN relays to conceal the attacker infrastructure, implements dual-layer encryption (WebRTC DTLS and ChaCha20-Poly1305 + ECDH), and has been observed in phishing-driven intrusions where a malicious MSI loads the backdoor in memory.