ShellCodeX
Tools • Events • News • Insights
SEO Checker
Threat Group Profile

chaos

● Active — last 30 days
Victim claims 34
First seen Sep 2023
Last activity 05 Aug 2026
Tracked since Mar 2025

Group overview

Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.

Preferred targets

Business Services · 7 Technology · 6 Manufacturing · 6 Healthcare · 4 Transportation/Logistics · 2 Agriculture and Food Production · 1

Most targeted countries

US · 22 CA · 3 DE · 3 RU · 2 GB · 2 MX · 1

Victim Claims Timeline

Back to radar
🇬🇧 United Kingdom

tomorrowsoffice.com

tomorrowsoffice.com

URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office (tomorrowsoffice.com) Status: Ongoing Data Publication Countdown Security researchers have success...

Professional Services
🇺🇸 United States

healthcarehighways.com

healthcarehighways.com

WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcarehighways.com) Countdown: 24 Hours If corporate representatives do not establish contact vi...

Healthcare
🇬🇧 United Kingdom

thecranewaregroup.com

thecranewaregroup.com

Craneware’s Public Deception: The Reality Behind the 'Non-Sensitive' Data Breach Recent public statements and regulatory filings by UK health-tech firm Craneware claim t...

Technology
🇷🇺 Russia

vit-best.com

vit-best.com

DATA BREACH NOTICE: VIT-BEST.COM Status: The first 3% of the total data (100%) has been published Countdown: 48 hours until the remaining 97% is published Situ...

Education
🇨🇦 Canada

remco.ca

remco.ca

Founded in 1977 and headquartered in Quebec, Canada, Remco is an industry leader in warehousing, transportation and country-wide distribution for the retail industry

Other
🇺🇸 United States

neopharmlabs.com

neopharmlabs.com

Notice of Data Escalation: 3% Proof Publication Management is ignoring the seriousness of the situation and refusing to engage in dialogue. We are publishing a 3% sample...

Healthcare
🇺🇸 United States

issvc.com

issvc.com

issvc.com Official Notice to Management and Stakeholders The time window has expired. Exactly 24 hours remain until the final deadline. If an agreement is not reached b...

Technology
🇷🇺 Russia

argonautms.com

argonautms.com

Target Organization: argonautms.com (Argonaut Manufacturing Services) Status: Unauthorized Access & Data Exfiltration Confirmed Volume: 295 GB of Critical Corporate, Te...

Technology
🇺🇸 United States

wikoff.com

wikoff.com

[PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Data Volume: 650 GB Status: Full Compromise Confirmed We are officially confirming that the entire int...

Business Services
🇺🇸 United States

radiax.com

radiax.com

NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that we have gained full access to the internal network and sensitive data infrastructure of Radiax.com....

Technology
🇺🇸 United States

spectrumchemical.com

spectrumchemical.com

Public Notice: Final Ultimatum to Spectrum Chemical Management To the Management of Spectrum Chemical: We have provided you with sufficient time to engage in a producti...

Manufacturing
🇺🇸 United States

aphenapharma.com

aphenapharma.com

Aphena Pharma Solutions We have gained full access to your corporate infrastructure. During this operation, we stole 142 GB of your most critical corporate data. The st...

Healthcare
🇺🇸 United States

opportune.com

www.zoominfo.com/c/opportune-llp/147440067

DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are officially announcing that our security team has successfully breached the internal network of Opport...

Business Services
🇺🇸 United States

corepharma.com

www.zoominfo.com/c/corepharma-llc/30217761

DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are officially announcing that our security team has successfully breached the internal network of CorePh...

Healthcare
🇺🇸 United States

gisy.com

www.zoominfo.com/c/grand-isle-shipyard-inc/50466057

Target: Gisy.com Status: Data Exfiltration Confirmed Volume: 1.1 TB (341,712 files) Deadline: 24 Hours We have successfully exfiltrated 1.1 Terabytes of internal data fr...

Technology
🇨🇦 Canada

aircreebec.ca

www.zoominfo.com/c/air-creebec-inc/901712

Air Creebec, founded in 1982, is a regional airline company based Waskaganish, Quebec. The company provides regular flights, air charter, medical transportation, and carg...

Transportation/Logistics
🇺🇸 United States

universalplant.com

www.zoominfo.com/c/universal-plant-services-inc/353963066

FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of 315 GB of your corporate, financial, and operational data. Our analysis confirms that this archive c...

Agriculture and Food Production
🇩🇪 Germany

ingerman.com

ingerman.com

Ingerman is a developer, builder and manager of multifamily housing communities throughout the Mid-Atlantic region.

Business Services
🇺🇸 United States

roofdepot.com

www.zoominfo.com/c/roof-depot-inc/348637856

Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a roofing manufacturer that specializes in roof installation, repairs & replacement

Construction
Unknown

randa.net

www.randa.net

Randa Apparel & Accessories is a global powerhouse and one of the world's leading apparel and lifestyle accessories companies, headquartered in New York City at 417 Fifth...

🇨🇦 Canada

graymont.com

graymont.com

NOTICE: Graymont – Final Warning We have successfully gained full access to the corporate infrastructure of Graymont. Our team currently holds a massive volume of highly...

Manufacturing
🇺🇸 United States

airespring.com

airespring.com

Founded in 2001, AireSpring is a Managed Services Provider specializing in Unified Communications, Managed Network, and IT Services, serving thousands of businesses natio...

Technology
🇺🇸 United States

powerhousenow.com

powerhousenow.com

STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Powerhouse (powerhousenow.com) THE REALITY OF POWERHOUSE We have been in possession of your internal data...

Business Services
🇺🇸 United States

entransinternational.com

entransinternational.com

STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Entrans International (entransinternational.com) THE REALITY OF ENTRANS INTERNATIONAL We have been in poss...

Business Services
🇺🇸 United States

sterlingindustries.com

www.zoominfo.com/c/sterling-industries/58132211

STERLING INDUSTRIES: FINAL NOTICE BEFORE FULL RELEASE STATUS: PENDING FINAL PUBLICATION ENTITY: Sterling Industries (sterlingindustries.com) LEAK SIZE: ~503 GB ATTENTIO...

Manufacturing
🇺🇸 United States

challenge-mfg.com

Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform...

Manufacturing
🇩🇪 Germany

wtitransport.com

www.wtitransport.com

Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform...

Transportation/Logistics
🇺🇸 United States

cstindustries.com

Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform...

Manufacturing
🇺🇸 United States

fallprotect.com

www.fallprotect.com

Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform...

Business Services
🇲🇽 Mexico

vacaero.com

vacaero.com

If the company's management does not reach an agreement with us within 4 days, we will publish 250 GB of the company's internal data. Founded in 1959, VAC AERO provides...

Hospitality and Tourism