Actor Profile

Chaos is a ransomware gang that emerged in early 2025, distinct from the same-named ransomware family active since 2021. The group has been linked to Iranian state-backed threat actor MuddyWater, who leveraged Chaos ransomware to disguise cyber-espionage operations as financially motivated attacks. The actor demonstrates advanced technical capabilities, developing custom tooling like the Rust-based msaRAT backdoor to maintain stealthy persistence and C2 communications within compromised environments.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved through email or voice phishing (T1566). The actor establishes persistence via remote management software installation (T1219). Execution occurs through an MSI installer masquerading as a Windows update (T1036.005), which loads msaRAT (lib.dll) directly into system memory using reflective DLL injection techniques. The malware hijacks Chrome or Edge browsers, launching them in headless mode and leveraging the Chrome DevTools Protocol (CDP) to establish C2 communications (T1071.001 - Web Protocols). Command and control is obfuscated through WebRTC channels routed via Twilio TURN servers and Cloudflare Workers endpoints, employing dual-layer encryption (WebRTC DTLS + ChaCha20-Poly1305 with ECDH key exchange). The malware executes Windows commands received through the encrypted channel (T1059).

Targets & Patterns

Recent Chaos ransomware attacks observed by Cisco Talos did not specify particular vertical sectors or geographic targeting patterns in the provided data. However, the group's association with MuddyWater—an Iranian state-backed APT—suggests potential targeting aligned with Iranian intelligence collection priorities. The use of ransomware as a cover for espionage operations indicates the actor may target organizations where both financial extortion and intelligence gathering objectives align, though specific victim profiles were not disclosed in the reporting.

Historical Context

Chaos ransomware emerged as a distinct operation in early 2025, separate from the unrelated Chaos ransomware family that existed since 2021. Rapid7 researchers identified earlier in 2025 that Iranian state-backed group MuddyWater was using Chaos ransomware to mask cyber-espionage activities as financially motivated attacks. The deployment of msaRAT represents an evolution in the group's operational tradecraft, demonstrating increased sophistication in C2 obfuscation techniques. This campaign, documented by Cisco Talos in July 2026, marks the first observed use of the msaRAT backdoor by the Chaos gang.

Defensive Recommendations

  • Monitor for Chrome or Edge browser processes launched with debugging flags (--remote-debugging-port, --headless) via process command-line logging (Sysmon Event ID 1) to detect CDP abuse
  • Implement network monitoring for unusual WebRTC traffic patterns, particularly connections to Twilio TURN servers lacking standard ICE candidates, which may indicate C2 tunneling
  • Block or restrict access to Cloudflare Workers domains (*.workers.dev) where operationally feasible, or implement enhanced logging and inspection for traffic to these endpoints
  • Detect MSI installer execution from non-standard locations or masquerading as Windows updates through file integrity monitoring and application control policies
  • Hunt for DLL injection into browser processes by monitoring for unsigned or suspicious DLLs loaded into chrome.exe or msedge.exe using EDR telemetry and Sysmon Event ID 7