Chaos ransomware utilizes WebRTC via headless browsers for C2 obfuscation

The Chaos ransomware variant msaRAT has adopted a new evasion technique by launching headless Chrome or Edge instances to tunnel command-and-control traffic through WebRTC. This method masks malicious communications as legitimate browser-based traffic, complicating network-level detection and traffic analysis.