New msaRAT malware uses Chrome, Edge browsers to route C2 traffic

Chaos ransomware gang is deploying a new backdoor dubbed msaRAT that uses a novel technique to obfuscate its command-and-control (C2) communications. This malware routes C2 traffic through legitimate Chrome and Edge browser processes, effectively blending in with normal web traffic to evade detection.

Technical Breakdown

• Threat Actor: Chaos ransomware gang
• Malware: msaRAT (backdoor)
• Key TTP: C2 Obfuscation (MITRE T1071.001 - Application Layer Protocol)
  • msaRAT routes C2 traffic through active Chrome or Edge browser processes.
  • This method allows malicious C2 traffic to appear as legitimate browser activity, making it harder for network monitoring and security solutions to detect.
• Functionality: The malware acts as a backdoor, implying capabilities like remote execution, data exfiltration, or further payload delivery, though specific details beyond C2 evasion are not provided in this summary.

Defense

Implement robust behavioral analytics within your EDR solutions to detect unusual network connections originating from browser processes, especially those connecting to non-standard or suspicious external destinations. Enhance network traffic analysis to identify anomalies within seemingly legitimate browser traffic patterns.

Source: https://www.bleepingcomputer.com/news/security/new-msarat-malware-uses-chrome-edge-browsers-to-route-c2-traffic/