Chaos — Ransomware Profile
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.IntelFusions coverage (2)
- Fake IT support calls on Microsoft Teams are ending in ransomware 2026-07-29 · Ransomware
- Chaos ransomware's new trojan hides its traffic inside your browser 2026-07-25 · Ransomware
Tools & malware
- AnyDesk Remote Monitoring and Management
- GoodSync Exfiltration Tool
- Impacket Post-Exploitation Framework
- Microsoft Quick Assist Living-off-the-Land
- OptiTune Remote Monitoring and Management
- ScreenConnect Remote Monitoring and Management
- Splashtop Remote Monitoring and Management
- Syncro RMM Remote Monitoring and Management
Recent claimed victims
- Cope Plastics 2026-09-08
- Evergen 2026-09-06
- macallister.com 2026-08-28
- corematerials.com 2026-08-28
- singleton.com 2026-08-27
- mswalker.com 2026-08-25
- copcp.com 2026-08-25
- parkderochie.com 2026-08-25
- tomorrowsoffice.com 2026-08-05
- healthcarehighways.com 2026-08-04
- thecranewaregroup.com 2026-07-28
- vit-best.com 2026-07-27
- remco.ca 2026-07-26
- issvc.com 2026-07-22
- neopharmlabs.com 2026-07-22
- argonautms.com 2026-07-21
- wikoff.com 2026-07-20
- radiax.com 2026-07-16
- aphenapharma.com 2026-07-14
- Sleeman Breweries 2026-07-14
- spectrumchemical.com 2026-07-14
- corepharma.com 2026-07-08
- opportune.com 2026-07-08
- Air Creebec 2026-07-06
- gisy.com 2026-07-06
Vendor research
- Unmasking the new Chaos RaaS group attacks Cisco Talos
- the original report Sophos
- discovered Cisco Talos