Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Chaos
As of Oct 19, 2026, Chaos has listed 103 confirmed victims on its leak site since Feb 19, 2025, 0.3% of all victims tracked by Brandefense. Its most targeted country is United States (77.7% of its victims) and its most targeted sector is Consulting.
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 103
- Rank By Victims
- #66
- Last Leak-Site Post
- Oct 9, 2026
- Top Country
- United States
- Top Sector
- Consulting
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 9 |
| June 2026 | 6 |
| July 2026 | 15 |
| August 2026 | 8 |
| September 2026 | 9 |
| October 2026 (month in progress) | 2 |
| Month | Confirmed victims |
|---|---|
| November 2025 | 3 |
| December 2025 | 7 |
| January 2026 | 2 |
| February 2026 | 2 |
| March 2026 | 6 |
| April 2026 | 5 |
| May 2026 | 9 |
| June 2026 | 6 |
| July 2026 | 15 |
| August 2026 | 8 |
| September 2026 | 9 |
| October 2026 (month in progress) | 2 |
| Month | Confirmed victims |
|---|---|
| February 2025 | 13 |
| March 2025 | 4 |
| April 2025 | 1 |
| May 2025 | 1 |
| June 2025 | 2 |
| July 2025 | 0 |
| August 2025 | 1 |
| September 2025 | 2 |
| October 2025 | 5 |
| November 2025 | 3 |
| December 2025 | 7 |
| January 2026 | 2 |
| February 2026 | 2 |
| March 2026 | 6 |
| April 2026 | 5 |
| May 2026 | 9 |
| June 2026 | 6 |
| July 2026 | 15 |
| August 2026 | 8 |
| September 2026 | 9 |
| October 2026 (month in progress) | 2 |
Latest Chaos Victims.
Search all 103 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| astranahealth.com astranahealth.com | USUnited States | Healthcare | Not stated | |
| parkdental.com parkdental.com | GBUnited Kingdom | Healthcare | 275 GB | |
| advantech.com advantech.com | TWTaiwan | Manufacturing | Not stated | |
| carolinaasthma.com carolinaasthma.com | USUnited States | Healthcare | Not stated | |
| expresspros.com expresspros.com | USUnited States | Consulting | Not stated | |
| glasfloss.com glasfloss.com | USUnited States | Non-profit and Civil Society | 402 GB |
How They Operate.
Chaos's threat actor profile lists 17 ATT&CK techniques, 1 exploited CVEs, 4 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Chaos Targets.
Sectors
History.
First confirmed victim listed on its leak site
First seen in Brandefense data
Busiest month on record: 15 confirmed victims
Most recent leak-site post
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.