“By intentionally omitting the ICE candidates that are normally present in standard WebRTC communications, P2P connections are prevented from being established, resulting in a design where all communications are always routed through TURN,” explains Cisco.
How msaRAT hijacks Chrome and Microsoft Edge
Researchers at Cisco Talos describe a new backdoor, msaRAT, that avoids direct network connections by commandeering a local installation of Chrome or Microsoft Edge. Written in Rust, the malware searches for a browser binary and launches it in headless mode — a process that runs without a visible window. Using the Chrome DevTools Protocol (CDP), msaRAT enables the browser’s remote debugging interface, opens a new tab, and injects JavaScript via CDP commands. That injected script builds the covert communication channel, bypasses Chrome’s Content Security Policy (CSP), and registers CDP bindings that let the malware exchange messages through the browser.
Cloudflare Workers signaling and Twilio TURN relays
The initial WebRTC signaling is handled through a Cloudflare Workers endpoint — is-01-ast[.]ols-img-12[.]workers[.]dev — which provides WebRTC connection information. Once the browser receives that signaling information it establishes a WebRTC session, but msaRAT deliberately prevents peer-to-peer (P2P) connections by omitting ICE candidates. Instead, communications are forced through Twilio TURN (Traversal Using Relays around NAT) servers configured to avoid direct P2P links.
Cisco Talos highlights a dual-layer encryption scheme: the browser-provided WebRTC DTLS channel plus an application-level ChaCha20-Poly1305 cipher with an ECDH-derived key implemented by msaRAT. Relaying over Twilio hides the attacker’s server IP in network traffic, and by using Cloudflare Workers for signaling the attacker’s infrastructure is further shielded behind Cloudflare’s address space.
The observed attack chain and payload delivery
Talos’ analysis places msaRAT in the context of Chaos ransomware group operations. Earlier stages observed by the team typically begin with email or voice phishing that leads to installation of remote management software to establish persistence. After gaining a foothold, attackers have been observed downloading an MSI installer masquerading as a Windows update; that MSI loads msaRAT’s payload — lib.dll — directly into system memory.
Once loaded, msaRAT avoids opening traditional network sockets to the C2 infrastructure and instead routes all C2 traffic through the hijacked browser session and the chained Cloudflare/Twilio infrastructure. Talos documented the malware’s messaging system as composed of “frames” that carry out key exchanges, channel open/close commands, session resets, and remote Windows command execution.
Rapid7 linkage and the evolution of the Chaos group
The report situates Chaos as a group that emerged in early 2025 and is distinct from a similarly named ransomware family active since 2021. Talos also notes earlier reporting from Rapid7 that linked Chaos infrastructure to activity by Iranian state-backed actors known as ‘MuddyWater,’ who leveraged the group to disguise espionage operations as financially motivated attacks. Talos now documents the use of msaRAT as a more sophisticated backdoor that nests C2 activity inside legitimate-looking browser traffic.
What this means for technologists, enterprises, and end users
- Technologists and security teams: Expect C2 traffic that never appears as a direct outbound socket to an attacker-owned IP. Detection efforts will need to account for unusual headless browser usage, CDP connections, and WebRTC sessions that rely on TURN relays rather than ICE-negotiated P2P links.
- Affected enterprises and procurement leaders: Blocking broad Cloudflare “*.workers.dev” subdomains is not a practical mitigation because the free workers.dev subdomain is used by legitimate services; the report makes clear that blocking it would disrupt benign Cloudflare Workers deployments.
- End users and IT operators: The initial infection vectors observed — email or voice phishing followed by installation of remote management tools and a malicious MSI posing as a Windows update — underline the continued relevance of phishing defenses, application control, and careful handling of update packages.
Cisco Talos published a full set of indicators of compromise (IoCs) associated with the msaRAT attacks; the report stresses that the combination of browser-based C2, Cloudflare signaling, and Twilio TURN relays materially complicates attribution and network detection. The technical picture Talos paints closes little off the table: commands are carried as framed messages through an encrypted, browser-mediated pipeline, and the attacker’s true endpoint does not appear in network captures the way traditional C2 does.
As defenders digest these specifics — lib.dll in memory, CDP-controlled headless browsers, the is-01-ast[.]ols-img-12[.]workers[.]dev signaling host, and TURN relays via Twilio — the practical question becomes whether existing monitoring and allowlist strategies can be adapted to detect malicious browser-embedded C2 without disrupting legitimate web services. Cisco Talos’ IoCs are the immediate place for teams to start.
