Chaos — Ransomware Profile
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.IntelFusions coverage (2)
- Fake IT support calls on Microsoft Teams are ending in ransomware 2026-07-29 · Ransomware
- Chaos ransomware's new trojan hides its traffic inside your browser 2026-07-25 · Ransomware
Tools & malware
- AnyDesk Remote Monitoring and Management
- GoodSync Exfiltration Tool
- Impacket Post-Exploitation Framework
- Microsoft Quick Assist Living-off-the-Land
- OptiTune Remote Monitoring and Management
- ScreenConnect Remote Monitoring and Management
- Splashtop Remote Monitoring and Management
- Syncro RMM Remote Monitoring and Management
Recent claimed victims
- Mickey Truck Bodies 2026-10-23
- astranahealth.com 2026-10-09
- parkdental.com 2026-10-01
- advantech.com 2026-09-29
- carolinaasthma.com 2026-09-29
- Express Employment Professionals 2026-09-17
- glasfloss.com 2026-09-14
- steelhausinc.com 2026-09-14
- ArtiFlex Manufacturing LLC 2026-09-10
- Mankato Clinic 2026-09-10
- Cope Plastics 2026-09-08
- Evergen 2026-09-06
- corematerials.com 2026-08-28
- macallister.com 2026-08-28
- singleton.com 2026-08-27
- mswalker.com 2026-08-25
- parkderochie.com 2026-08-25
- copcp.com 2026-08-25
- tomorrowsoffice.com 2026-08-05
- healthcarehighways.com 2026-08-04
- thecranewaregroup.com 2026-07-28
- vit-best.com 2026-07-27
- remco.ca 2026-07-26
- neopharmlabs.com 2026-07-22
- issvc.com 2026-07-22
Vendor research
- Unmasking the new Chaos RaaS group attacks Cisco Talos
- the original report Sophos
- discovered Cisco Talos