Actor Profile

Chaos is a ransomware group that operates through spam floods, vishing campaigns, Quick Assist abuse, and RMM tools for initial access and persistence. The group deploys custom tooling including the msaRAT implant as a pre-ransomware stage to establish covert command-and-control channels. Chaos is linked to financially motivated cybercrime activity targeting technology sector organizations. The group demonstrates moderate technical sophistication through custom Rust-based implants and novel C2 obfuscation techniques that leverage legitimate browser infrastructure.

TTPs (Tactics, Techniques, Procedures)

Initial access via social engineering (spam, vishing) and abuse of legitimate remote management tools (Quick Assist, RMM). Execution through MSI installers with embedded DLLs loaded directly into memory (T1218.007 Msiexec). Command execution via cmd.exe with specific flags (T1059.003 Windows Command Shell). Defense evasion through headless browser abuse: Chrome/Edge launched with --headless=new and --remote-debugging-port flags, driven via Chrome DevTools Protocol (CDP) to proxy C2 traffic through legitimate browser processes. C2 traffic routed through WebRTC data channels relayed by Twilio TURN infrastructure, with dual-layer encryption (DTLS + ChaCha20-Poly1305 with ECDH key exchange). All external connections appear to originate from legitimate browser processes communicating with Cloudflare and Twilio, masking attacker infrastructure. Staging via plain HTTP over port 443 to evade port-based firewall rules. Pre-ransomware reconnaissance and data exfiltration capabilities through flow-controlled send queues designed for large payloads (screenshots, files).

Targets & Patterns

Chaos targets the technology sector, as disclosed in this campaign. The group's documented playbook of spam floods and vishing suggests broad opportunistic targeting rather than highly selective victim profiling. The use of social engineering and legitimate remote access tools indicates targeting of organizations where employees can be manipulated into granting initial access. The deployment of msaRAT as a pre-ransomware implant suggests the group prioritizes establishing persistent, covert C2 channels before deploying encryptors, likely to maximize data theft opportunities and ensure reliable command execution during the ransomware deployment phase. The choice of technology sector victims may reflect higher ransom payment potential and valuable intellectual property for double extortion tactics.

Historical Context

msaRAT represents an evolution in C2 obfuscation tradecraft, building on techniques documented by security researchers in 2025-2026. Praetorian demonstrated in August 2025 that conferencing platforms' TURN infrastructure could carry full C2 channels, and Sansec identified a skimmer in March 2026 using WebRTC data channels to exfiltrate stolen payment card data past HTTP inspection. msaRAT synthesizes both approaches within a Chaos-linked Rust implant that automates headless browser manipulation through CDP. The malware adapts to Google's March 2025 security change (Chrome 136+) that disabled CDP debugging against default profiles to counter infostealer cookie theft—msaRAT circumvents this by bringing its own profile directory. This represents the first observed integration of headless browser abuse, WebRTC C2 tunneling, and ransomware group operations in a single implant, indicating Chaos has adopted cutting-edge evasion techniques from multiple threat domains.

Defensive Recommendations

  • Hunt for Chrome or Edge processes launched by non-interactive parents (installers, services, scheduled tasks) with command-line arguments containing both --headless=new and --remote-debugging-port flags, correlating with loopback traffic to the debugging port
  • Monitor for Runtime.addBinding and Runtime.evaluate CDP messages in browser telemetry, particularly when associated with headless browser instances or unusual parent processes
  • Detect MSI installer execution (T1218.007) followed by immediate DLL loading into memory and subsequent browser process creation, especially when MSI properties impersonate legitimate Windows updates
  • Implement protocol-aware firewall rules rather than port-based filtering to prevent plain HTTP traffic over port 443 (e.g., curl.exe downloading MSI files from suspicious IPs over HTTP on TCP/443)
  • Correlate headless browser processes with outbound WebRTC connections to TURN/STUN infrastructure (e.g., global.turn.twilio.com) and Cloudflare Workers domains (workers.dev), flagging combinations that lack legitimate business justification or occur outside CI/automation contexts