msaRAT: Chaos ransomware's Rust RAT builds C2 through the Chrome DevTools Protocol so the malware process never opens a socket

Cisco Talos documented msaRAT, a Rust-based remote-access trojan deployed by the Chaos ransomware-as-a-service group, whose architecture is built to defeat the "which process opened this socket" heuristic that endpoint tooling relies on (Cisco Talos, 2026-07-23). The RAT process itself opens no external network connection. Instead it launches and controls a headless Chrome/Edge instance through the Chrome DevTools Protocol (CDP), a legitimate browser-debugging API: it connects to the browser's local CDP WebSocket (127.0.0.1 only), registers CDP bindings, and uses Runtime.evaluate to inject JavaScript that fetches STUN/TURN configuration from a Cloudflare Workers endpoint, negotiates a WebRTC PeerConnection/DataChannel (ICE plus SDP offer/answer over HTTP POST to the same Workers endpoint), and routes all subsequent C2 commands over that DataChannel through a Twilio TURN relay, double-encrypted with DTLS plus ChaCha20-Poly1305 (Cisco Talos, 2026-07-23). Because every externally-visible connection originates from the signed browser binary rather than the malware, network- and process-attribution telemetry shows only ordinary Chrome/Edge traffic to Cloudflare and Twilio infrastructure that most estates already allow.