Onyx is a destructive ransomware group built on the Chaos builder that overwrites files instead of encrypting them to prevent recovery.
Onyx is a ransomware group built on the Chaos ransomware builder, active since April 2022, claiming around 13 victims across six countries. Its key TTP involves overwriting files larger than 2MB with random data instead of encrypting them, rendering recovery impossible. Defenders should prioritize robust backup integrity checks and deploy file integrity monitoring to detect anomalous overwrite attempts early.
Onyx is a ransomware group first observed in April 2022, based on the Chaos ransomware builder, that is notably destructive — files larger than 2MB are overwritten with random data rather than encrypted, making recovery impossible even after ransom payment — claiming approximately 13 victims across six countries.
Onyx overwrites files larger than 2MB with random data instead of encrypting them, rendering recovery impossible.
Defenders should prioritize robust backup integrity checks and deploy file integrity monitoring to detect anomalous overwrite attempts early.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.