Chaos
Chaos is a ransomware group with a financial motive, tracked by Brandefense. It targets 13 sectors, including Government and Technology, in 15 countries, including the United States and the United Kingdom. It uses 17 MITRE ATT&CK techniques and exploits 1 known CVE.
- Chaos RaaS
- Techniques
- 17
- Exploited CVEs
- 1
- First seen
- Jan 1, 2025
- Last seen
- Sep 8, 2026
- Record updated
Who They Target.
About Chaos.
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Last updated Sep 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.