Chaos Ransomware Group Uses msaRAT Trojan to Hide C2 Traffic Through Invisible Chrome and Edge Browsers
The Chaos ransomware group has begun using a new trojan called msaRAT to hide its command-and-control communications inside legitimate connections made by Chrome and Edge browsers.
The malware was discovered on a compromised Windows system prior to the deployment of the ransomware encryptor. Written in Rust, msaRAT does not connect directly to the attackers' infrastructure. Instead, it starts a browser instance in invisible mode and controls it through the Chrome DevTools Protocol, ensuring that the process's network traffic remains limited to the local machine address.
The implant injects JavaScript code into the browser and uses a Cloudflare Workers service to negotiate a WebRTC connection. After negotiation, traffic is forwarded through Twilio TURN servers, preventing the real address of the attackers' servers from appearing in network logs. Received commands are executed via cmd.exe.
The malware also features queuing and flow-control mechanisms that support reliable transfer of files, screenshots, and other large data volumes. In the analyzed attack, operators downloaded an MSI installer presented as a Windows update. The package loaded a DLL containing msaRAT directly into memory, minimizing artifacts written to disk.
The technique does not exploit vulnerabilities in Chrome or Edge. Its goal is to make malicious traffic appear as normal browser activity and to leverage services that are widely permitted in corporate environments.
Related articles
Ransomware Operators Hijack Active Directory via GPO to Lock Companies Without Encryption
Kaspersky researchers have uncovered a new extortion campaign called Payload that targets manufacturing companies by compromising privileged accounts and seizing control of Active Directory. Instead of deploying traditional ransomware encryptors, the attackers created a Group Policy Object named Payload linked to the domain root. This GPO automatically changed desktop wallpapers and lock screens across all systems, displayed ransom demands, and disabled administrative accounts after policy refresh. The group also exfiltrated valuable corporate data before the lockdown and later published it on the dark web to increase pressure on victims. Because the attack relied entirely on legitimate Windows mechanisms such as VPN access and Group Policy, conventional antivirus solutions proved ineffective. Experts recommend monitoring GPO changes, enforcing phishing-resistant MFA on VPN and admin systems, and applying least-privilege principles to limit the impact of credential compromise.
SETTRA Ransomware Deploys MeshAgent and gdrv.sys BYOVD Against Windows Systems
Huntress analysts have identified two separate incidents involving the newly observed SETTRA ransomware targeting Windows environments. The attacks combined the legitimate MeshAgent remote management tool with a Bring Your Own Vulnerable Driver technique using gdrv.sys to disable security controls. Victims included a consumer services and retail company hit in July and an industrial organization compromised in September. Initial access occurred through VPN connections or previously stolen credentials, after which operators deployed MeshAgent to maintain persistence and execute commands. Before encryption, the group deleted Windows event logs, disabled system recovery features, removed recovery partitions, and overwrote free disk space. Encrypted files received the .locked or .locked_wip extensions, with the ransomware binary named after the victim domain and ransom notes dropped as RESTORE_FILES.txt.
Ukrainian Developer of LockerGoga, MegaCortex and Nefilim Ransomware Sentenced to 12 Years and Nine Months
A 52-year-old Ukrainian national has been sentenced by the Zurich District Court to 12 years and nine months in prison for his role as the lead developer of the LockerGoga, MegaCortex and Nefilim ransomware strains. The court determined that the malware he created was deployed against companies across dozens of countries, causing approximately 100 million Swiss francs in damages in the cases examined. Notable victims included train manufacturer Stadler Rail, which suffered the theft of around 500 GB of confidential data and a $6 million ransom demand in 2020, as well as climate equipment supplier Meier Tobler and banking software developer Crealogix. The defendant claimed he was performing ordinary cybersecurity consulting and was unaware of the intended use of his code, but investigators found ransom demand templates alongside the source code, undermining his defense. He has been in custody since October 2021 as part of a wider international investigation into attacks affecting more than 1,800 individuals and organizations in 71 countries. Upon release he will be banned from entering Switzerland for ten years, although the verdict remains subject to appeal.
Android Ransomware Mantax Otax Encrypts Files and Streams Victim Screen in Real Time
Researchers at Zimperium have identified a new Android ransomware strain called Mantax Otax that combines file encryption with live screen recording and surveillance capabilities. The malware is distributed through sideloaded APK files delivered via messaging apps and phishing messages rather than official app stores. Once installed, it uses AES encryption to lock files with the .enc extension and conducts ransom negotiations directly on the infected device through an on-screen chat interface. In addition to encryption, Mantax Otax continuously captures the screen, saves footage as MP4 video, and streams it to operators while also photographing the surroundings with the device camera. The malware abuses accessibility services to read on-screen content, intercepts SMS messages to steal two-factor authentication codes, and exfiltrates contacts, call logs, browser history, and credentials from WhatsApp and Telegram. It also displays a fake lock screen to capture the device PIN. Impact is reduced on Android 10 and later due to Scoped Storage restrictions, though surveillance functions remain active. Evidence points to a targeted campaign against users in Indonesia.