Chaos ransomware

Who Chaos is

Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.

Recorded activity

Disclosures attributed to Chaos in this database run from March 2025 to October 2026, totalling 105 victims — 0.4% of everything tracked here. Chaos has listed victims in 17 countries in this database, most often United States, followed by United Kingdom and Germany. The sectors appearing most in its listings are Manufacturing, Technology, Healthcare.

Indicators of compromise

• 160f60dc3fc9920cfc3847de4de2ef09
• 9113f4b245da32c75d61b467ee89e0b7
• 87fd821b67a1f329548f222d81a55be7
• 7c4b465159e1c7dbbe67f0eeb3f58de1caba293999a49843a0818480f05be14e
• 11cfea4100ba3731d859148d2011c7225d337db22797f7e111c0f2876e986490
• 1d846592ffcc19ed03a34316520aa31369218a88afa4e17ac547686d0348aa5b
• 144.172.103.42
• 45.61.134.36
• 107.170.35.225

Showing a sample of 3 MD5, 3 SHA256, 3 IP on file. Hashes and network indicators published for Chaos. Leak-site addresses are deliberately excluded. Indicators age quickly — treat a match as a starting point for investigation, and an absence of matches as no assurance.

YARA detection rules

rule ransomware_win_chaos {
    meta:
        id = "c1876a18-0618-44e2-8919-b4a041de97e7"
        description = "Detects the Chaos Ransomware"
        author = "Sekoia.io"
        version = "1.0"
        creation_date = "2022-01-18"
        classification = "TLP:CLEAR"
        
    strings:
        $rep00 = "\\Desktop" wide
        $rep01 = "\\Links" wide
        $rep02 = "\\Contacts" wide
        $rep03 = "\\Documents" wide
        $rep04 = "\\Downloads" wide
        $rep05 = "\\Pictures" wide
        $rep06 = "\\Music" wide
        $rep07 = "\\OneDrive" wide
        $rep08 = "\\Saved Games" wide
        $rep09 = "\\Favorites" wide
        $rep10 = "\\Searches" wide
        $rep11 = "\\Videos" wide
        $rep12 = "C:\\Users\\" wide
        
        $str0 = "svchost.exe" wide
        $str1 = "\\privateKey.chaos" wide
        $str2 = "Chaos Ransomware" wide
        $str3 = "read_it.txt" wide
        $str4 = "<EncryptedKey>" wide
        $str5 = "passwordBytes" ascii
        $str6 = "lookForDirectories" ascii
        $str7 = "Rfc2898DeriveBytes" ascii
        $str8 = "ICryptoTransform" ascii
        $str9 = "FromBase64String" ascii
        
        $ext0 = ".torrent" wide
        $ext1 = ".ibank" wide
        $ext2 = ".wallet" wide
        $ext3 = ".swift" wide
        $ext4 = ".onetoc2" wide
        
    condition:
        uint16(0) == 0x5a4d and
    filesize > 50KB and filesize < 2MB and
        6 of ($str*) and 10 of ($rep*) and 4 of ($ext*)
}

Community-contributed rules for Chaos, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.