Chaos is an affiliate-based extortion crew active since early 2025. It is a separate operation from the older Chaos builder variants. Victims see the .chaos extension and a note called readme.chaos.txt. The locker supports Windows, ESXi, Linux and NAS targets. Intrusions often start with spam floods and phone calls in which the caller poses as IT support and asks for a Quick Assist session. Data is pulled out with GoodSync, then the group threatens a leak and DDoS. Its encryptor options and note style point to a successor of BlackSuit and Royal.
File extensions: 4 random characters, .0w2h, .Deadline, .fucked, .locked, .owonegerpro, .us00, .wf1d, .encrypt, .encrypted, .f**ked, An extension consisting of four random characters is added., Files are appended with an extension comprising four random characters, Four random characters, .Azazel, .BlackHatUP, .cebrc, .clown, .COBRA, .Cyber, .DeathGrip, .DumbStackz, .escovinda, .geometrical, .GetAnAntivirus, .google, .hackedbySnea575, .HAHAHAIAMABULLY, .jinwooksjinwooks, .LMAO
Ransom note filenames: read_it.txt, DecryptFiles.txt, DECRYPTION INSTRUCTIONS.txt, for dencrypt, INSTRUCTIONS.txt, L bozo.txt, LEIA-ME.txt, note.txt, OceanCorp.txt, OPEN_ME.txt, OPEN_THIS.txt, Pooop-ransom.txt, READ THIS.txt, read_it, read_it_cobra.txt, Read_me.txt, read_mt.txt, README_txt.txt, Red_Tel.txt, WAGNER.txt, Warning.txt, Windows!System32.txt
Decryptor: A free decryptor is available.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161