msaRAT: Rust-Based RAT Using TURN Relays and Headless Browsers
msaRAT is a Rust-based remote access trojan attributed to the Chaos ransomware group. It uses a headless browser and WebRTC DataChannels via…
Tag: TURN
Chaos Ransomware Group: Deploys msaRAT and TURN-Based C2
The Chaos ransomware group is attributed to the msaRAT malware, which uses Twilio TURN relays and headless browsers for covert C2 communication.…
Twilio: TURN Relay Service Abused by msaRAT
msaRAT uses Twilio TURN relays to establish WebRTC DataChannels between the browser and C2 server.
Backdoor.Turn: Go-Based RAT Abusing Microsoft Teams TURN
Backdoor.Turn is a Go-based remote access trojan used by DragonForce ransomware to hide C2 traffic inside Microsoft Teams relay infrastructure via QUIC…
Carbon Black: Co-Documented Backdoor.Turn
Carbon Black, alongside Symantec, detailed the Backdoor.Turn RAT's use of TURN relays for C2 communication.
Praetorian: Disclosed Ghost Calls Technique and Swarmer Tool
Praetorian publicly disclosed the Ghost Calls technique for TURN relay abuse and released the Swarmer tool used by TWINLOOT for stealthy registry…
Microsoft Teams: TURN Relays Abused for C2
TWINLOOT and other malware abuse Microsoft Teams TURN servers to relay WebRTC DataChannels for interactive operator access.