OTX Threat: Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel
AI Summary
Cisco Talos discovered msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware group. This sophisticated RAT never directly touches the network, instead controlling command-and-control communications exclusively through Chrome DevTools Protocol (CDP). It manipulates browsers via CDP, performs signaling with Cloudflare Workers, and establishes WebRTC DataChannels using Twil
Discussion
Sign in to join the discussion.
Loading comments…