Chaos hides command traffic behind the browser

Cisco Talos has analysed msaRAT, a new Rust-based remote access trojan attributed to the Chaos ransomware group. The malware is delivered as an MSI file named update_ms.msi, built to mimic Windows Update, and loads its embedded DLL payload directly into memory. Once running, msaRAT launches Chrome or Edge in headless mode, enables the Chrome DevTools Protocol remote debugging interface and uses Cloudflare Workers for WebRTC signalling. Command-and-control traffic is then relayed through Twilio's legitimate TURN service, so the msaRAT process itself only talks to localhost while the external traffic appears to originate from the browser.

What this means for you if you are responsible for detection

This attack is built to slip past your monitoring. The traffic comes from a process that is supposed to talk to the internet. It is also aimed at services you already trust. The way we read it, that combination is the entire point of the design.

If your detection rests on blocklists and suspicious destinations, it will not catch this. If ransomware ranks high on your risk register, our assessment is that this is where you have most to gain. A foothold can sit with you for a long time before anyone notices.

Berigo recommends

• Block installation of MSI files from user directories and download folders using application control.
• Build detection for browser processes launched in headless mode or with remote debugging flags.
• Review whether your endpoint tooling logs process creation with command lines, and whether those logs are retained long enough to be useful.
• Exercise a ransomware scenario in which the command traffic was never spotted on the network, only the encryption that followed.

Source

• blog.talosintelligence.com