Chaos

Chaos is a financially motivated ransomware-as-a-service operation that began recruiting affiliates in February 2025 and published its first known data-leak-site victim in March 2025. Also known as Chaos ransomware or the Chaos ransomware group, it operates an open affiliate model. It is distinct from the unrelated Chaos ransomware builder released in 2021. Its targeting predominantly affects United States organizations across healthcare, manufacturing, technology, financial services, business services, and transportation. Chaos affiliates use spam flooding, voice phishing, and Microsoft Teams help-desk impersonation to persuade employees to grant remote access through Microsoft Quick Assist. They deploy legitimate remote-management products, including AnyDesk, ScreenConnect, and other RMM tools, to maintain redundant access. Post-compromise activity includes Active Directory and domain-trust reconnaissance, network scanning, credential dumping, Kerberoasting, and lateral movement through RDP, WMI, SMB execution, and remote-management software. Operators also use reverse SSH tunnels and GoodSync for data exfiltration. Defense-evasion techniques include masquerading as legitimate Windows processes, clearing PowerShell logs, removing security products, and hiding accounts. The operation combines data theft and encryption with publication threats and threatened DDoS attacks, forming a triple-extortion model; actual DDoS execution is not established. Chaos maintains a data leak site and uses publication deadlines and selective disclosure to pressure victims. Its encryptor supports Windows, Linux, ESXi, and NAS environments, although documented Linux and ESXi incidents are limited. Encryption uses Curve25519 ECDH and AES-256 with per-file keys and supports partial-file encryption. Operators impair recovery by deleting shadow copies and interfering with backup and recovery mechanisms. The service also offers AI chat agents to assist with extortion negotiations.