Chaos RAT Masquerades as Windows Update

How the attack worked

Cisco Talos identified a remote access trojan, tracked as msaRAT, linked to the Chaos ransomware group. The infection chain starts with an MSI installer disguised as a routine Windows update. Once downloaded, often via a curl.exe command that pulls the file into ProgramData, the attacker executes it on the victim's machine. From there, the malware launches Chrome or Edge and controls the browser using the Chrome DevTools Protocol, allowing it to blend command-and-control traffic into ordinary browser activity.

The network side of this attack is what makes it notable. After an initial HTTPS negotiation, the malware communicates over encrypted WebRTC/DTLS traffic. To further obscure attacker infrastructure, the channel relies on trusted cloud services, including Cloudflare Workers for signaling, Google STUN, and a Twilio TURN relay. This means the traffic pattern looks close to legitimate cloud and video/voice service usage rather than a typical malware beacon.

Why it succeeded

The social engineering hook is simple: a fake Windows update. Employees are conditioned to install updates promptly, and an installer that looks like a routine patch is unlikely to raise suspicion on its own. Chaos is described as operating as ransomware-as-a-service, using both vishing calls and spam email for initial access, which gives the group two separate paths to convince a target to run the installer, either through a phone call from someone posing as IT support or through an email attachment.

Because the malicious traffic hides inside normal browser and cloud-service behavior, network-based detection alone struggles to catch it. Endpoint visibility into what actually launched the browser process becomes far more useful than watching the wire.

What to watch for

• An unexpected "Windows update" delivered as a standalone MSI installer rather than through normal patch management
• Instructions, by email or phone, to manually run an installer or a command-line tool like curl.exe to fetch software
• A Chrome or Edge process starting with a remote debugging port or an unusual user-data directory shortly after an installer runs
• Phone calls pressuring immediate installation of an update outside normal IT ticketing or change processes

Building resistance

Organizations can reduce risk by reinforcing that legitimate Windows updates come through managed patch tooling, not standalone installers requested by phone or email. IT helpdesk staff and executive assistants, who are common social engineering targets, should be trained to verify any unsolicited update request through a separate, trusted channel before acting. Encouraging staff to report unusual device behavior after running any installer, such as unexpected browser activity, helps close the gap between infection and detection. Finally, security teams should remember that attackers increasingly hide inside trusted applications and cloud services, so endpoint monitoring of process launches deserves as much attention as network monitoring.

How does msaRAT get onto a victim's machine?

It is delivered as an MSI installer impersonating a Windows update, often pulled down via a curl.exe command into ProgramData and then executed by the attacker.

Why is this malware hard to detect on the network?

Once running, it launches Chrome or Edge and controls the browser via the Chrome DevTools Protocol, tunneling commands over encrypted WebRTC traffic that looks like normal HTTPS negotiation.

Does this attack involve phone calls, not just email?

Yes, the Chaos ransomware-as-a-service group is described as using both vishing calls and spam email for initial access before double extortion.

What should employees watch for after installing an update?

Any unusual browser behavior right after running an installer, such as Chrome or Edge starting with a remote debugging port, is a red flag worth reporting.