Cisco Talos has identified a new Rust-based remote access trojan (RAT) dubbed "msaRAT," which is being deployed by the Chaos ransomware group. This sophisticated malware leverages the Tokio asynchronous runtime and establishes a covert command-and-control (C2) channel by hijacking Chrome or Edge browsers through the Chrome DevTools Protocol (CDP).
The infection process begins with a deceptive MSI file, disguised as a Windows update, which loads the msaRAT payload directly into memory. This in-memory execution allows the RAT to evade traditional file-based detections, setting the stage for subsequent ransomware deployment.
A key characteristic of msaRAT is its evasion capability. It avoids direct network interaction for its C2 infrastructure by routing traffic through legitimate browser processes and trusted services. This method allows it to bypass many conventional network-based detection mechanisms. The use of the Tokio runtime further enhances its efficiency, enabling parallel execution of malicious tasks and accelerating the attacker's ability to establish persistence and deploy double-extortion ransomware.
Defenders are advised to monitor for unusual `curl` commands, particularly those downloading MSI files to the `ProgramData` directory or sending plain HTTP traffic over port 443. Scrutiny should be applied to unexpected MSI files impersonating Windows updates and any unauthorized manipulation of Chrome or Edge browsers. Implementing behavioral monitoring is also recommended to detect abuse of the Chrome DevTools Protocol and unauthorized WebRTC connections.
In related cybersecurity developments, Cisco also introduced Antares, a new family of security small language models (SLMs). These models are specifically designed to pinpoint the locations of known vulnerabilities within a codebase, aiming to improve vulnerability localization efforts.
Meanwhile, the cybersecurity landscape continues to face a growing volume of threats. Data from the second quarter of 2026 indicates a 49% year-over-year growth in tracked CVEs, with nearly 200 new CVEs being identified daily by the end of June. Despite this surge in new vulnerabilities, the growth of actively exploited vulnerabilities (KEVs) was comparatively modest at 13%.
A significant concern remains the persistence of older vulnerabilities. Approximately 24% of all tracked CVEs date back to 2024 or earlier. More strikingly, 46% of currently actively exploited CVEs (KEVs) originated in 2025 or earlier, even though standard enterprise patch cycles are typically described as running between 30 and 90 days. This highlights a persistent challenge where machine-speed vulnerability discovery continues to outpace human-speed patching.
Prioritization tools like EPSS (Exploit Prediction Scoring System) are increasingly important for managing this influx. For instance, while patching purely based on CVSS 9+ scores would involve approximately 3,700 CVEs, 95% of these have an EPSS score below 5%, indicating a low real-world probability of exploitation. Of the 32 CVSS 9+ CVEs with an EPSS score of 50% or higher, 25 are already on CISA's Known Exploited Vulnerabilities (KEV) list, leaving a small number of high-probability, unlisted CVEs for defenders to monitor.
Other notable incidents include a hacker wiping Romania's entire land registry database following an extortion attempt, which paralyzed the country's real estate market. Additionally, attackers are widely exploiting a chain of vulnerabilities, CVE-2026-60137 and CVE-2026-63030, against WordPress sites, potentially affecting millions. Progress Software has also advised ShareFile customers using Storage Zone Controllers to shut them down due to a security threat, and researchers have warned that patching alone may not be sufficient for a deserialization flaw in Microsoft SharePoint, recommending credential rotation for potentially exposed assets.
