Threat Group Profile
chaos
● Active — last 30 days
Victim claims
34
First seen
Sep 2023
Last activity
05 Aug 2026
Tracked since
Mar 2025
Group overview
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Preferred targets
Business Services · 7
Technology · 6
Manufacturing · 6
Healthcare · 4
Transportation/Logistics · 2
Agriculture and Food Production · 1
Most targeted countries
US · 22
CA · 3
DE · 3
RU · 2
GB · 2
MX · 1