chaos
Known ransomware group Established actor
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
4
Total Claims
3
Critical
—
Records Claimed
2
Industries Hit
Active span: Apr 14, 2026 – Oct 1, 2026 · 4 organizations targeted
Established actor
Actor Threat Profile
Activity Timeline
Peak: Sep 2026 (2)Apr 2026
LessMore
Oct 2026Share this profile
Top Targeted Industries
Healthcare 3
Consumer Services 1
Tradecraft & Infrastructure
0
Documented tools
0 / 0
MITRE tactics / techniques
2
Known leak sites
Targeted Organizations
Claims by chaos
Critical
Ransomware Claim: parkdental.com
parkdental.com
chaos
Ransomware Healthcare
Oct 1, 2026 Critical
290 GB leaked Ransomware Claim: carolinaasthma.com
carolinaasthma.com
chaos
Ransomware Healthcare
Sep 29, 2026 Critical
Ransomware Claim: mankatoclinic.com
mankatoclinic.com
chaos
Ransomware Healthcare
Sep 11, 2026 Medium
Ransomware Claim: coastappliances.com
coastappliances.com
chaos
Ransomware Consumer Services
Apr 15, 2026