THREATOPS

THREAT OPS › Threat News › Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

medtalosPublished 2026-07-23

<ul><li>Cisco Talos has discovered a new Rust-based remote access trojan (RAT) we call “msaRAT” attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: “msaOpen,” “msaClose,” “msaError,” and “msaMessage”.</li><li>msaRAT is implemented using the Tokio asynchronous runtime, with pr

MITRE ATT&CK techniques

Adversary-in-the-MiddleT1557
IP AddressesT1590.005
JavaScriptT1059.007
Social EngineeringT1684
Reverse ShellAML.T0072

Indicators of compromise

http://172.86.126.18:443/update_ms.msiurl
https://tokio.rs/url
172.86.126.18ipv4
storage.ghost.iodomain
global.turn.twilio.comdomain

Original source: https://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channel/