chaos
Known ransomware group ACTIVE Currently active
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
2
Total Claims
1
Critical
—
Records Claimed
2
Industries Hit
Active span: Apr 14, 2026 – Sep 10, 2026 · 2 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: Apr 2026 (1)Apr 2026
LessMore
Sep 2026Share this profile
Top Targeted Industries
Healthcare 1
Consumer Services 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
2
Known leak sites