Chaos RaaS (2025) ransomware

Chaos RaaS is the ransomware-as-a-service crew that surfaced around February 2025 and recruits affiliates on a Russian-language forum. It shares only its name with the much older Chaos builder family, and the crew appears to have picked the name to muddy attribution, so match on artifacts, not the word. Files from this crew end in .chaos and sit beside a note named readme.chaos.txt; each encrypted file also carries a 60-byte trailer holding a per-run public key. Only part of each file is encrypted, at a percentage the operator sets, which makes the run fast while still ruining the file. Shadow copies are deleted at start-up, and shares on every reachable host in the local subnets are queued for encryption. The note gives no price, only a victim-specific onion chat; demands reported from negotiations reached $300K. The crew advertises lockers for Windows, ESXi, Linux and NAS. The free Chaos decryptor that Truesec published in 2022 and No More Ransom lists was written for the older builder family, before this encryptor existed, and is not built for these files. Entry is social engineering: staff are flooded with spam, then a caller posing as IT security talks them into a Quick Assist session. The intruders then install remote-management software (AnyDesk, ScreenConnect, Splashtop and others), hide a new account from the login screen, reset domain passwords and open a reverse SSH tunnel. Data is copied out with GoodSync and a sync tool disguised as wininit.exe before encryption, and the crew runs a leak site and threatens DDoS and telling clients and competitors if the ransom is refused. Its encryption method, note layout and tooling point to former BlackSuit (Royal) members, an assessment held with moderate confidence rather than proven.

Sources: Cisco Talos, Truesec

File extensions: .chaos

Ransom note filenames: readme.chaos.txt

Decryptor: Decryptor availability has not been recorded. Checked 2026-10-29.