August 1, 2026
- msaRAT hides its C2 behind Cloudflare so the attacker's own server address never appears on the wire (via cyb3rops). · Threat Activity
in When the Attacker Is a Model: AI Lands on Both Sides of the Fight
tagged
[msarat]
2 editions · 2 items
July 24, 2026
- msaRAT, a new Rust backdoor from the Chaos ransomware crew, tunnels C2 through headless Chrome/Edge and WebRTC. Cisco Talos found it abusing the Chrome DevTools Protocol and WebRTC DataChannels, ChaCha20-Poly1305-encrypting payloads, and hiding behind Twilio TURN and Cloudflare Workers to blend into legitimate traffic. Talos, BleepingComputer. · Threat Activity