Cisco Talos finds Rust based msaRAT using Chrome for covert C2

The article discusses msaRAT, a Rust-based remote access trojan associated with the Chaos ransomware group, identified by Cisco Talos. The malware is delivered post-intrusion using a disguised MSI installer that mimics a Windows update. Once installed, msaRAT launches a hidden browser process (Chrome or Edge), utilizing the Chrome DevTools Protocol for command-and-control (C2) communication. This design makes traffic indistinguishable from normal browser traffic, complicating detection.

Further, the RAT employs double encryption for data handling, making it hard to intercept. Chaos ransomware operates under a ransomware-as-a-service model, and detection strategies involve monitoring host behaviors rather than relying solely on network filters. Effective defenses include recognizing unusual browser flags and monitoring WebRTC sessions. The article emphasizes the need for vigilance in network security due to the evolving tactics of cyber threats.