Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Chaos ransomware operators are deploying a tool identified as msaRAT to facilitate communication between infected systems and malicious command-and-control servers. By utilizing headless versions of Google Chrome and Microsoft Edge, the malware routes its traffic through browser processes to masquerade as standard web activity.

Coverage from Help Net Security, Security Affairs, CyberSecurityNews, Cisco Talos, and The Hacker News highlights the shift toward "living off the browser" to bypass traditional network security detection. These reports emphasize that the technique forces security solutions to distinguish between legitimate user-initiated browser traffic and malicious command operations.

Future developments remain dependent on whether security software can effectively monitor headless browser processes without disrupting standard operations. Coverage does not yet specify the scope of current infections or the specific methods intended for long-term remediation.