Threat Group Profile
chaos
● Active — last 30 days
Victim claims
22
First seen
Sep 2023
Last activity
08 Jul 2026
Tracked since
Mar 2025
Group overview
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Preferred targets
Business Services · 6
Manufacturing · 5
Technology · 2
Transportation/Logistics · 2
Healthcare · 1
Agriculture and Food Production · 1
Most targeted countries
US · 15
DE · 3
CA · 2
MX · 1
