Chaos Ransomware
A ransomware-as-a-service group first confirmed in February 2025. It floods staff with spam, phones them posing as IT, then uses remote tools to steal data and encrypt. It shares a name with an older ransomware builder, but Cisco Talos believes the two are unrelated.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Several things are called Chaos, and this profile covers only the ransomware-as-a-service group Talos describes. Talos believes it is unrelated to the older Chaos builder and may use the name to create confusion.1 That builder dates from June 2021, and later variants include Onyx and Yashma.3 Fortinet separately reported a C++ variant in 2025, which deletes large files and hijacks copied Bitcoin wallet addresses.4 AttackIQ presents the 2025 operation as a re-emergence of the older family, which conflicts with Talos, so we do not merge them.3
The method relies on people. A victim's inbox is flooded with spam, an actor posing as IT security staff talks them through Microsoft Quick Assist, and legitimate remote tools then maintain access.1 Talos reports demands around $300,000, with threats to leak data, launch DDoS attacks and tell clients and competitors.1
Talos says victims were mostly in the US, with fewer in the UK, New Zealand and India, according to the group's leak site, and that targeting across sectors was opportunistic.1 In July 2026 it reported msaRAT, a tool that routes command traffic through a headless Chrome or Edge browser so it looks like normal browser traffic.2
If a report mentions Chaos, check which one it means, because indicators and advice from the builder family may not apply to this group. For this group, we would focus on how staff verify IT callers and on remote tool control.
How It Attacks
Based on Cisco Talos incident response reporting.1,2
- 1
Flood and Call
Floods a victim with spam, then speaks to them by phone while posing as IT security staff.
- 2
Open a Remote Session
Directs the victim to Microsoft Quick Assist.
- 3
Keep Access
Installs remote management tools, creates hidden accounts and resets passwords.
- 4
Learn the Network
Enumerates networks, domain trusts and users, and likely attempts Kerberoasting.
- 5
Remove Obstacles
Deletes logs and uninstalls MFA software.
- 6
Move and Steal
Moves using RDP, SMB and WMI, and takes data with GoodSync and cloud upload tools.
- 7
Encrypt and Extort
Deletes shadow copies, encrypts files, then threatens leaks and DDoS.
Key Techniques
ATT&CK v20 has no group entry for this group, and the ATT&CK software entry named Chaos (S0220) is unrelated Linux malware. Mapping follows Talos.1,5
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1667 | Email Bombing | Impact | Floods the victim with spam before the call. |
| T1598.004 | Spearphishing Voice | Reconnaissance | Calls the victim posing as IT security staff. |
| T1219 | Remote Access Tools | Command and Control | Uses Quick Assist and RMM tools. |
| T1558.003 | Kerberoasting | Credential Access | Likely attempted, according to Talos. |
| T1685 | Disable or Modify Tools | Defence Impairment | Uninstalls MFA software and clears logs. |
| T1021.001 | Remote Desktop Protocol | Lateral Movement | Moves over RDP. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Sends data to cloud storage. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files using selective encryption. |
Tools Observed
Remote Access
Custom Malware
Movement and Discovery
Data Theft
From Talos.1,2 Many are legitimate products, so check whether a tool is approved and expected.
Vulnerabilities
Talos does not name a CVE as a way into these attacks.1
Warning Signs
Our inference from the behaviour Talos describes.1,2 None of these proves an attack alone.
- A burst of spam followed by a call from IT
- Quick Assist sessions after an unsolicited call
- New RMM tools or hidden accounts
- MFA software being uninstalled
- Headless Chrome or Edge started with remote debugging on a server
- GoodSync on servers
Defences That Matter
Make IT Support Verifiable
- Tell staff how IT will and will not contact them.
- Teach them to report spam floods followed by a call.
Control Remote Tools
- Restrict Quick Assist and allowlist approved RMM tools.
- Alert on new RMM installs and hidden accounts.
Protect Identity
- Alert when MFA software is removed.
- Review service accounts exposed to Kerberoasting.
Plan for Pressure
- Rehearse a response that includes DDoS and contact with clients, as these are threatened.1
Would Your Staff Hang Up on a Fake IT Call?
We can test how your people and remote access controls respond to the methods in this profile.
Sources
- Cisco Talos: Unmasking the new Chaos RaaS group attacks, 24 July 2025
- Cisco Talos: Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel, 23 July 2026
- AttackIQ: Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities, 16 July 2026
- Hackread: New Chaos-C++ Ransomware Targets Windows by Wiping Data, Stealing Crypto, 9 October 2025
- MITRE ATT&CK: Chaos (S0220), ATT&CK v20
- BleepingComputer: FBI seizes $2.4M in Bitcoin from new Chaos ransomware operation, 29 July 2025
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.