The Chaos ransomware gang is using msaRAT, a Rust-based backdoor, to hide command-and-control communication by routing it through Chrome or Edge browsers to evade detection. Cisco Talos found the malware on a compromised Windows machine before the gang deployed ransomware encryption.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
The Chaos ransomware gang is using a new backdoor dubbed msaRAT that hides command-and-control (C2) communication by routing it through the Chrome or Edge browsers. https://www. bleepingcomputer.com/news/secu rity/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/
New msaRAT malware uses Chrome, Edge browsers to route C2 traffic https://www. bleepingcomputer.com/news/secu rity/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/?utm_source=dlvr.it&utm_medium=%5Binfosec.exchange%5D
Cisco Talos said it found msaRAT, a Rust-based remote access trojan it attributes to the Chaos ransomware group, on a compromised Windows machine before ransomware encryption activity [talosintelligence.com#1][thehackernews.com#1]. The malware routes command-and-control communications through Chrome or Microsoft Edge instead of opening its own outbound network connection, so network defenders may
🤖 New msaRAT backdoor from the Chaos ransomware gang routes C2 communication through Chrome/Edge browsers, blending malicious traffic with legitimate browser activity to evade detection. 🔗 https://www. bleepingcomputer.com/news/secu rity/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/ # Malware # Ransomware # CyberSec