Actor Profile

Chaos is a ransomware gang that emerged in early 2025, distinct from the earlier same-named ransomware family active since 2021. The group has been linked to Iranian state-backed threat actor MuddyWater, who reportedly leveraged Chaos ransomware to disguise cyber-espionage operations as financially motivated attacks. The actor demonstrates advanced technical capabilities, including custom malware development in Rust and sophisticated C2 obfuscation techniques. Their operations blend ransomware deployment with persistent backdoor access, suggesting dual objectives of financial gain and long-term network compromise.

TTPs (Tactics, Techniques, Procedures)

Initial access via email or voice phishing (T1566). Establishes persistence through remote management software installation. Delivers msaRAT backdoor via MSI installer masquerading as Windows update (T1036.005 - Masquerading: Match Legitimate Name or Location). Executes reflective DLL loading (lib.dll) directly into memory (T1620 - Reflective Code Loading). Hijacks Chrome or Edge browsers in headless mode, enabling remote debugging interface via Chrome DevTools Protocol (CDP). Injects JavaScript into browser tabs to establish C2 channel (T1059.007 - Command and Scripting Interpreter: JavaScript). Routes C2 traffic through legitimate browser processes (T1090 - Proxy) using WebRTC connections via Cloudflare Workers and Twilio TURN servers. Implements dual-layer encryption (WebRTC DTLS + ChaCha20-Poly1305 with ECDH key exchange) for C2 communications (T1573 - Encrypted Channel). Executes Windows commands through the browser-based C2 channel (T1059 - Command and Scripting Interpreter).

Targets & Patterns

Recent Chaos campaigns observed by Cisco Talos did not specify particular vertical sectors or geographic targeting patterns. The use of social engineering (email and voice phishing) as initial access vectors suggests opportunistic targeting rather than sector-specific focus. However, the connection to Iranian state-backed actor MuddyWater indicates potential strategic targeting aligned with Iranian intelligence priorities when Chaos ransomware is used as cover for espionage. The dual-use nature of the msaRAT backdoor—enabling both ransomware deployment and persistent access—suggests the actor may target organizations with valuable data or those of geopolitical interest to Iranian state sponsors, while maintaining the appearance of financially motivated cybercrime.

Historical Context

Chaos ransomware emerged in early 2025 as a new operation, unrelated to the earlier Chaos ransomware family active since 2021. In early 2025, Rapid7 researchers identified that Iranian state-backed threat actor MuddyWater was leveraging Chaos ransomware to disguise cyber-espionage operations as financially motivated attacks. This represents a notable evolution in Iranian APT tradecraft, blending state-sponsored espionage with ransomware-as-cover tactics. The deployment of msaRAT in recent campaigns (observed by Cisco Talos in 2026) demonstrates continued technical sophistication and operational maturity, with the custom Rust-based backdoor representing a significant advancement in C2 obfuscation capabilities compared to earlier Chaos operations.

Defensive Recommendations

  • Monitor for Chrome or Edge processes launched with remote debugging flags (--remote-debugging-port, --headless) via EDR telemetry and process command-line logging (Sysmon Event ID 1)
  • Inspect outbound WebRTC connections and flag unusual TURN server usage, particularly connections to Twilio infrastructure lacking standard ICE candidates in network traffic analysis
  • Detect MSI installer executions from non-standard paths or user directories, especially those claiming to be Windows updates, using application control policies and file integrity monitoring
  • Block or alert on Chrome DevTools Protocol (CDP) usage outside approved development environments by monitoring TCP connections to localhost debugging ports (typically 9222)
  • Implement behavioral detection for reflective DLL loading patterns, focusing on memory-only execution of unsigned DLLs (lib.dll) without corresponding disk artifacts
  • Monitor for JavaScript injection into browser processes via CDP commands by analyzing browser extension activity and unexpected script execution in headless browser sessions
  • Restrict access to Cloudflare Workers domains (*.workers.dev) where operationally feasible, or implement enhanced logging and inspection of traffic to these endpoints