Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own. Its process talks to 127.0.0.1 and nothing else. It starts Chrome or Edge in headless mode and drives the browser

Cisco Talos reports that the Chaos ransomware group is deploying a Rust-based remote access tool, msaRAT, which launches Chrome or Edge in headless mode and routes all command-and-control (C2) traffic through the victim’s own browser, making communications appear as legitimate browser activity.[1][2][3][6][7] The implant itself only talks to 127.0.0.1, uses browser DevTools/WebRTC channels, and never opens direct outbound connections, significantly complicating traditional network-based detection.[1][2][6][7] From a RealGround perspective, this "living off the browser" pattern is directly relevant to AI-powered or browser-embedded agents: any autonomous agent that drives headless browsers or devtools APIs could be abused in a similar way to proxy stealthy C2 or data exfiltration, so organizations should emulate and test for such techniques via continuous AI red teaming and harden agent architectures against covert tunneling abuses.