Chaos is a Ransomware-as-a-Service operation by former BlackSuit/Royal members offering cross-platform ransomware.
Analyst brief
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members. It targets various sectors including Technology, Healthcare, Manufacturing, Education, and Retail & E-Commerce primarily in the United States, Canada, United Kingdom, Russia, and Germany, while excluding CIS/BRICS countries and hospitals from its targeting. The actor provides cross-platform ransomware for Windows, Linux, ESXi, and NAS environments to affiliates recruited via the RAMP dark web forum. Defenders should focus on network segmentation, especially protecting NAS devices and ESXi servers, and remain vigilant against initial access vectors like potential phishing campaigns.
chaos
activecrime
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.