Chaos
ObscureIQ Threat Intelligence · Actor Profile
ChaosConfidence: Medium
Ransomware (RaaS)
Also known as: Chaos (2025 RaaS)
Motivation: Financial
1Attributed Breaches
MediumAttribution Confidence
Ransomware (RaaS)Actor Type
Overview
Assessed with moderate confidence by Cisco Talos to be formed by former BlackSuit/Royal members, first observed early 2025 (distinct from the 2021 Chaos builder) and using triple extortion. Avoids BRICS/CIS targets and demands up to ~$300K.
Tactics, Targeting & TTPs
Avoids BRICS/CIS targets; runs a leak site; demands up to ~$300K.
Source
Attribution draws on public threat-intelligence reporting · Established (multi-source). Primary source →
Were you exposed in one of these breaches?
Check your exposure privately, or request a tailored exposure audit.