Chaos ransomware’s msaRAT hijacks browsers to hide C2 traffic via WebRTC
Talos uncovered msaRAT, a Rust‑based RAT used by the Chaos ransomware gang. It never opens its own network sockets; instead it steers Chrome via the DevTools Protocol to set up a WebRTC DataChannel through a Twilio TURN relay, masking the attacker’s IP. This browser‑borne C2 channel can slip past traditional network defenses.