Loading story…
Chaos is an active ransomware-as-a-service operation assessed with moderate confidence to include former BlackSuit/Royal operators from the broader Conti lineage. First observed recruiting on the RAMP forum in February 2025, the group had published 42 victims on its leak site by late March 2026 and uses triple extortion: data theft, file encryption, and threats of distributed-denial-of-service attacks. The operation is distinct from the unrelated 2021 Chaos ransomware builder.
Reported intrusions begin with spam flooding and voice phishing that pressure targets into granting Microsoft Quick Assist access. Operators then deploy legitimate remote-management tooling, steal credentials, move laterally, and exfiltrate data with GoodSync before encrypting Windows, Linux, VMware ESXi, and NAS systems. The encryptor uses Curve25519 ECDH and AES-256 with per-file keys, appends the .chaos extension, and drops README.chaos.txt; its focus on identity compromise and hypervisor/Linux environments reflects wider ransomware trends.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
By late March 2026, Chaos had named 42 victims on its leak site.
The U.S. Department of Justice seized BlackSuit infrastructure. Chaos is assessed with moderate confidence to involve former BlackSuit/Royal operators.
Chaos listed its first known victim on its leak site.
The Chaos ransomware-as-a-service operation was first observed recruiting affiliates on the RAMP forum.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourceextrahop.com
Open sourcecyble.com
Open sourceany.run
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chaos ransomware has undergone a significant transformation in 2025, resurfacing with a new variant written in C++ rather than its previous .NET implementation. This marks a notable shift in the malware's development, indicating a move toward more sophisticated and potentially evasive techniques. The new Chaos-C++ variant targets Microsoft Windows systems and is capable of encrypting most files on compromised machines, resulting in a high-severity impact for affected users. In addition to traditional file encryption and ransom demands, the updated ransomware introduces destructive extortion tactics, increasing the pressure on victims to comply with attackers' demands. A particularly concerning feature of this variant is its clipboard hijacking mechanism, which is designed to steal cryptocurrency by monitoring and replacing clipboard contents related to wallet addresses. The ransomware is distributed via a downloader that masquerades as a legitimate utility called 'System Optimizer v2.1,' deceiving users with fake optimization messages while covertly deploying the malicious payload. During execution, the downloader creates a hidden log file, 'sysopt.log,' in the %TMP% directory to record details of the payload's download and execution. The actual ransomware payload is written to a temporary file with a randomized name, further complicating detection and analysis. The downloader uses hardcoded strings and attempts to launch the payload using the CreateProcessA() function with specific flags to avoid user detection. Technical analysis reveals that the C++ implementation allows for more efficient and potentially faster execution, as well as the integration of new features not present in earlier .NET-based versions. The evolution of Chaos ransomware reflects a broader trend of ransomware operators adopting more aggressive and financially motivated tactics, including data destruction and cryptocurrency theft. Security researchers emphasize the importance of understanding these new attacker tactics to assess organizational exposure and prioritize defensive measures. The shift to C++ may also indicate an attempt to evade signature-based detection tools that were tuned for the .NET variant. Organizations are urged to remain vigilant, update their security controls, and educate users about the risks of downloading and running suspicious utilities. The technical details provided in the analysis offer valuable insights for defenders seeking to detect and mitigate this evolving threat. The emergence of clipboard hijacking as part of the ransomware's toolkit highlights the increasing convergence of ransomware and information-stealing malware. This development underscores the need for comprehensive endpoint protection and user awareness training to counteract sophisticated social engineering and technical evasion techniques. The Chaos-C++ variant's operational changes and enhanced capabilities represent a significant escalation in the threat landscape for Windows users worldwide.
Jun 29, 2026
The **Maze** ransomware operation evolved from earlier exploit-kit activity associated with “ChaCha ransomware” into a prominent double-extortion threat that stole data before encrypting systems and then pressured victims by publishing stolen files on dedicated leak sites. Operators built a public reputation around naming victims, courting media attention, and using data exposure as leverage to increase the likelihood of ransom payments. Maze infections were delivered through multiple channels, including spam campaigns impersonating government tax agencies and later more targeted compromises through **Remote Desktop Protocol (RDP)** access and network exploitation. Sophos reported that the malware used heavy obfuscation, anti-analysis checks, persistence mechanisms, system and network reconnaissance, **HTTP POST** data exfiltration, and file encryption based on **RSA** and **ChaCha20**, while also showing selective behavior such as adjusting demands for home versus corporate systems and easing pressure in some medical-sector cases during COVID-19.
Jun 29, 2026
Sophos reported that the **Dharma** ransomware operation, also known as **CrySis**, continues to profit as a ransomware-as-a-service scheme by targeting small and medium-sized businesses through high-volume intrusions. Investigators said many attacks begin with compromised or poorly secured **Remote Desktop Protocol (RDP)** access, often using stolen credentials purchased on criminal forums, before affiliates move deeper into victim networks and deploy the ransomware payload. The operation relies on a standardized affiliate toolkit built around a menu-driven PowerShell script, **`toolbelt.ps1`**, that automates much of the attack chain for low-skill operators. Sophos said the toolkit combines Windows utilities, legitimate freeware, public exploits, and custom scripts for credential theft with **Mimikatz**, reconnaissance, Active Directory discovery, lateral movement, antivirus disruption, Tor-based communications, and final encryption, while a two-stage decryption process keeps affiliates dependent on core operators for key retrieval and victim support.
Aug 15, 2026