Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware,…
msaRAT is a Rust-based remote access trojan attributed to the Chaos ransomware group. It uses a headless browser and WebRTC DataChannels via…
The Chaos ransomware group is attributed to the msaRAT malware, which uses Twilio TURN relays and headless browsers for covert C2 communication.…
Cisco Talos provided analysis of msaRAT, highlighting its use of Chrome DevTools Protocol and Twilio TURN for covert C2.