The Chaos ransomware group ran its command-and-control through the victim's own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant never opens an outbound connection of its own.
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Summary + source link. No paywalls, no tracking.