Unmasking the new Chaos RaaS group attacks
Summary: A new ransomware-as-a-service group calling itself Chaos emerged as early as February 2025, advertising cross-platform ransomware for Windows, ESXi, Linux and NAS systems on the Russian-speaking RAMP forum and recruiting affiliates. Talos IR observed the group carrying out big-game hunting and double extortion, gaining initial access through phishing and voice phishing that convinced a victim to launch Microsoft Quick Assist and connect to the actor's session.
Key Takeaway: In one observed intrusion the actor demanded $300,000 and, on non-payment, threatened to publish stolen data, run DDoS attacks on all internet-facing services, and tell the victim's competitors and clients about the breach. The group's encryptor was compiled as recently as May 2025 and is built to evade debugging tools, virtual machines and sandboxes, so an environment that looks clean to automated analysis may not be.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·