Chaos ransomware uses browser-based C2 to evade network detection

The Chaos ransomware group has deployed a new Rust-based remote access trojan, msaRAT, which disguises command-and-control traffic by routing it through legitimate web browsers. By launching Chrome or Microsoft Edge in headless mode with remote debugging enabled, the malware utilizes the Chrome DevTools Protocol to manage communications. This design ensures that all external network activity appears to originate from standard browser processes rather than malicious infrastructure.
Source

👉@sysadminoff

https://4sysops.com/archives/chaos-ransomware-uses-browser-based-c2-to-evade-network-detection/