Skip to content
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

The Chaos ransomware group ran its command-and-control through the victim’s own browser. Cisco Talos on Thursday detailed msaRAT, the Rust implant behind it, found on a compromised Windows machine ahead of the encryptor. The implant… 

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

Swati KhandelwalJul 23, 2026Malware / Threat Intelligence An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin…