Actor Profile

Chaos is a ransomware group that operates through spam floods, vishing campaigns, Quick Assist abuse, and RMM tools for initial access and persistence. The group deploys custom tooling including the msaRAT Rust-based implant as a pre-ransomware stage to establish covert command-and-control channels. Chaos is linked to financially motivated cybercrime operations targeting technology sector organizations. The group demonstrates moderate technical sophistication through custom malware development and novel C2 obfuscation techniques that leverage legitimate browser processes and cloud infrastructure to evade network detection.

TTPs (Tactics, Techniques, Procedures)

Initial access via social engineering (spam, vishing) and remote access tools (T1566, T1219). Execution through MSI installers with embedded DLLs loaded directly into memory (T1218.007). Command execution via cmd.exe (T1059.003). C2 obfuscation by launching Chrome/Edge in headless mode with Chrome DevTools Protocol (T1071.001, T1090.001), routing traffic through WebRTC data channels and Twilio TURN relays to mask true C2 infrastructure. Encrypted C2 using ChaCha-Poly1305 over DTLS (T1573). Persistence through RMM tools (T1219). Pre-ransomware reconnaissance and staging before encryptor deployment (T1486).

Targets & Patterns

Chaos primarily targets the technology sector, though the disclosed incident does not specify victim identity or geographic focus. The group's use of broad social engineering campaigns (spam floods, vishing) suggests opportunistic targeting rather than highly selective victim profiling. The deployment of msaRAT as a pre-ransomware implant indicates the group seeks to establish persistent, covert access for data exfiltration and lateral movement before encryption operations. The choice of technology sector victims may reflect higher ransom payment capacity and valuable intellectual property for double extortion tactics.

Historical Context

The msaRAT implant represents an evolution in Chaos ransomware group's tooling, incorporating techniques documented by security researchers in 2025-2026. The use of TURN infrastructure for C2 follows Praetorian's August 2025 research demonstrating conferencing platforms' relay abuse. WebRTC data channel exfiltration was observed by Sansec in March 2026 in payment card skimmers. msaRAT synthesizes both approaches within a Chaos-specific Rust implant. The group's documented playbook of spam, vishing, and Quick Assist abuse aligns with established Chaos TTPs. Chrome's March 2025 restriction on debugging flags against default profiles (effective Chrome 136) was bypassed by msaRAT's use of custom profile directories, showing the group adapts to defensive countermeasures.

Defensive Recommendations

  • Hunt for Chrome or Edge processes launched with --headless=new and --remote-debugging-port flags by non-interactive parents (installers, services, scheduled tasks) using process telemetry (Sysmon Event ID 1, EDR)
  • Monitor for loopback TCP connections to high-numbered ports (CDP debugging) correlated with outbound WebRTC traffic to STUN/TURN services from the same browser process
  • Detect Chrome DevTools Protocol abuse by inspecting CDP WebSocket traffic for Runtime.addBinding and Runtime.evaluate method calls, particularly with suspicious callback names
  • Block or alert on MSI installations from ProgramData directories and inspect custom actions that load embedded DLLs directly into memory (T1218.007)
  • Implement protocol-aware firewall rules that inspect HTTP traffic on non-standard ports (e.g., port 443 serving plain HTTP) to catch staging infrastructure abuse