Chaos Ransomware Gang Deploys New msaRAT Malware to Evade Detection via Browser Traffic

The Chaos ransomware gang has deployed a new backdoor malware variant named msaRAT, utilizing legitimate web browsers and cloud services to mask command-and-control communications. The campaign was identified on July 23, 2026.

Security researchers observed the group leveraging WebRTC protocols within Google Chrome and Microsoft Edge browsers to route malicious traffic through Cloudflare Workers. This technique allows the attackers to blend their infrastructure commands with standard browser activity, making it significantly more difficult for network defenders to distinguish between legitimate user behavior and compromised systems. By masking command-and-control signals inside encrypted web traffic destined for trusted cloud providers, Chaos aims to bypass traditional intrusion detection systems that rely on identifying known malicious IP addresses or unusual port usage.

The msaRAT backdoor represents a shift in operational tactics designed specifically to enhance the group's persistence within targeted networks. Instead of establishing direct connections to attacker-controlled servers, which are frequently flagged and blocked by security vendors, the malware establishes sessions through intermediary cloud functions. These Cloudflare Workers act as proxies, receiving instructions from the attackers and relaying them to infected endpoints via WebRTC data channels embedded in browser processes.

This method exploits the inherent trust organizations place in major technology platforms like Google, Microsoft, and Cloudflare. Because the traffic originates from or passes through these reputable services using standard web protocols, it often evades scrutiny by firewalls and endpoint protection tools configured to allow such connections for business operations. The use of WebRTC is particularly effective as it facilitates peer-to-peer communication that can appear indistinguishable from video conferencing or real-time collaboration applications commonly used in corporate environments.

The deployment of msaRAT underscores a broader trend among ransomware operators seeking more sophisticated methods to maintain access to victim networks before deploying encryption payloads. By obscuring their command infrastructure, groups like Chaos increase the likelihood that infections will go undetected for extended periods, allowing them to map network assets and escalate privileges without triggering alarms.

As of now, it remains unclear how many organizations have already been compromised by this specific variant or if other ransomware syndicates are adopting similar browser-based evasion techniques. The reliance on third-party cloud infrastructure also raises questions about the potential for abuse monitoring within these services to detect such patterns in real-time. Cybersecurity teams are urged to monitor WebRTC traffic and Cloudflare Worker interactions closely, as traditional signature-based detection may prove insufficient against this evolving threat vector.