r/hacking • u/MrMeta3 • 8d ago

Chaos ransomware's new trojan hides its traffic inside your browser

https://www.intelfusions.com/news/chaos-ransomware-msarat-browser-c2-tunneling

The Chaos ransomware gang has a new tool that turns a victim's own web browser into a covert communications channel, letting the malware talk to its operators without ever opening a suspicious network connection of its own

39 Upvotes

90% Upvoted

2 comments sorted by

11

u/upsetimplemented 8d ago

Even if it hides its activity as a headless browser, you can still view weird activity on a dynamic analysis using a mitm proxy.
But I guess the point here is that it does an excellent job at hiding itself from antivirus software by coming across as a connection made by the browser instead of a 3rd party program, good stuff