Scrappy RAT Malware Targets Chrome And Edge Users

A new remote access trojan (RAT) has been discovered by the cybersecurity research team at Cisco Talos, and experts are sounding the alarm since it enables the installation of ransomware on the victim's system. The attack is dubbed msaRAT and attributed to the Chaos ransomware group, built with Rust to utilize existing Chrome or Edge (Chromium-based) browser installations. By leveraging the browser's ordinary communication methods, msaRAT is able to disguise its traffic with Chrome's DevTools Protocol and enable command-and-control (C2) communications without detection from typical anti-malware or antivirus software.

Once the attackers have successfully infiltrated a target network with msaRAT malware, numerous possibilities emerge. The malware runs via a headless (no window/invisible) browser process and can be used to perform remote code execution on the target machines. Besides opening the door for the Chaos group's ransomware, it also enables covert data theft and more.

While the potential scale of msaRAT attacks could extend to the entirety of Microsoft Edge and Google Chrome's userbase, the Chaos ransomware group typically targets large organizations. Common users could still be targeted, but the information shared by Cisco Talos doesn't include examples or an estimated scope of msaRAT attacks, and just identifies the novel approach and hard-to-detect nature of msaRAT.


Additionally, msaRAT is an example of post-compromise malware, that is, malware already installed through phishing emails or malicious files. It cannot be mitigated through browser patches, and because of its novel approach, traditional firewalls and network monitoring tools will most likely fail if defenders are not aware of the specific nature of the attack.

To protect from msaRAT, Cisco Talos advises adding the following SNORT rules (SIDs) to detect and block it:

• Snort 2: 1:66840, 1:66841, 1:66839
• Snort 3: 1:301587, 1:66839

While most users aren't going to be targeted by an attack like this, we advise any readers tied to a large enterprise to utilize the above information appropriately or send it to your relevant IT staff. If msaRAT does appear on a system, the time window between then and ransomware installation is thin, and confidential data exfiltration may have already occured.

Image Credit: Cisco Talos