⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Attack Groups

Chaos Ransomware Group: Deploys msaRAT and TURN-Based C2

August 18, 2026

The Chaos ransomware group is attributed to the msaRAT malware, which uses Twilio TURN relays and headless browsers for covert C2 communication. The group is also linked to STAC4749 and TWINLOOT operations.