msaRAT double-layer C2 encryption: ChaCha-Poly1305 over DTLS with ECDH handshake indicators

Emiliano Mema@Nosalva

•updated Aug 20, 2026•0•0•2

Detects endpoint security scanner hits indicating the presence of msaRAT malware, specifically identifying its characteristic double-layer encryption scheme (DTLS transport paired with application-layer ChaCha-Poly1305 encryption) triggered by a 0xFE handshake frame.