Ransomware Group intelligence
Chaos
ActiveTrack Chaos with 126 published victims and 3 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Chaos is tracked by Breach House as a ransomware group with 126 published victims.
United States is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
92
- Leaked 31 33.7%
- Pending 61 66.3%
- Deleted 0 0.0%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 2h ago | hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion |
| Leak location 2 | Onion service | Up checked 2h ago | hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion |
| Leak location 3 | Onion service | Down checked 2h ago | cdgi6zjox6zr5epk7k5rg673qduxy7dlkk7ws3n4vusspr5bmhx24aqd.onion |
Top Activity Sectors (14)
- Manufacturing / Engineering 23
- Services 10
- IT 10
- Communication / Marketing 10
- Healthcare / Pharma 9
- Not identified 7
- Retail / E-commerce 5
- Finance / Legal / Insurance 4
- Hospitality / Food & Beverage / Tourism 3
- Transportation / Travel / Logistics 3
- Construction / Real Estate 3
- Energy 3
- Telecommunications 1
- Agriculture / Food 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Chaos, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: chaos executes PowerShell scripts to spread payloads and manipulate system processes.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: chaos adds malicious registry run keys to ensure persistence across reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: chaos disables antivirus tools by terminating security processes and modifying system configurations.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: chaos deletes Volume Shadow Copies and backup files via vssadmin and built-in deletion commands.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: chaos performs remote system discovery via Nmap scans to map the victim network topology.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1049 System Network Connections Discovery Discovery
What they do: chaos enumerates system network connections to identify active services and communication endpoints.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1135 Network Share Discovery Discovery
What they do: chaos scans network shares using SMB tools to identify additional victims for encryption.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: chaos moves laterally through SMB/Windows Admin Shares to compromise additional networked systems.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: chaos encrypts victim files using custom ransomware binaries targeting critical data directories.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: chaos invokes system recovery inhibition commands to prevent backup restoration attempts.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme.chaos.txt
Hello, Our name is Chaos, and we would like to inform you about an important issue regarding the security of your systems.We conducted a professional security test, which fortunately was successful. The system's protection failed to function properly, and as a result, all confidential data was downloaded, including financial reports, internal communications, client databases, and other crucial materials that could have a significant impact on your business. This is not just a matter of lost information, but also potential legaland reputational consequences. We fully understand that the leakage of such data could lead to serious issues for your company. However, there is an opportunity to resolve this situation while keeping all information confidentialand preventing further leakage. To achieve this, a few steps need to be taken. We offer a peaceful resolution to the matter, ensuring that all data remains confidential. In exchange for compensation, all issues will be closed, and there will be no consequences for your company. This is the only way to avoid severe problems. To discuss further, please follow the link below with TOR Browser to get in touch with me.There, we can go over the details: http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion/chat/[snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (126)
Search, filter and paginate the victim timeline for Chaos. Showing 101–126 of 126.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | lesker.com id24392 View details | United States | Manufacturing / Engineering | pending | ||
|
Since it's foundation in 1954, Kurt J. Lesker Company has manufactured and sold vacuum equipment and parts to the electronic and communications related industries |
||||||
| Ransomware | dakkota.com id24377 View details | United States | Manufacturing / Engineering | pending | ||
|
Founded in 2001, Dakkota Integrated Systems is a manufacturing company that provides a variety of build-to-order manufacturing processes including cockpit, overhead, and fascia systems and more. |
||||||
| Ransomware | mToilet id24160 View details | Poland | Energy | pending | ||
|
mToilet is a company that operates in the Sporting & Recreational Equipment Retail industry. |
||||||
| Ransomware | Metropolitan Adjustment Bureau id23878 View details | United States | Finance / Legal / Insurance | pending | ||
|
Metropolitan Adjustment Bureau is a public insurance adjusting firm with over 50 years of experience assisting homeowners and businesses with insurance claims related to fire, water, earthquake, and disaster damage. |
||||||
| Ransomware | iconinternational.com id23827 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
ICON International, Inc. is a corporate barter firm that offers innovative solutions and strategic thinking to help brands grow and create economic value. |
||||||
| Ransomware | DeCeTe id23418 View details | Germany | Other | pending | ||
|
DeCeTe Duisburger Container-Terminalgesellschaft mbH |
||||||
| Ransomware | hanson-inc.com id23331 View details | United States | Services | pending | ||
|
Hanson Professional Services Inc. is a national consulting firm that specializes in engineering, planning, and allied services. They provide a wide range of services including aviation, asset management, construction support, and sustainability solutions, catering to various sectors such as healthca… |
||||||
| Ransomware | www.msssolutions.com id22919 View details | United States | Services | pending | ||
|
Founded in 1996, MSS Solutions is a full-service Mechanical Contractor offering Design-Build, Design-Assist, and complete implementation services. The company specializes in new construction, large-scale renovations, and retrofit/replacement projects for HVAC, Fire, Security and Controls systems. Th… |
||||||
| Ransomware | ebaengineering.com id22869 View details | United States | Manufacturing / Engineering | pending | ||
|
EBA Engineering is a multidisciplinary engineering firm focused on providing exceptional, client-centered experiences with a commitment to delivering results. They offer a wide range of services including construction management, civil site engineering, geotechnical engineering, and asset management… |
||||||
| Ransomware | www.rocketstores.com id22868 View details | United States | Retail / E-commerce | pending | ||
|
$738.9 Million | Gas Stations, Convenience & Liquor Stores Retail |
||||||
| Ransomware | indiesemi.com id22867 View details | United States | Manufacturing / Engineering | pending | ||
|
indie offers highly innovative automotive semiconductors and software solutions for Advanced Driver Assistance Systems (ADAS), including LiDAR, connected car, user experience and electrification applications. |
||||||
| Ransomware | archway.com id22858 View details | United States | Services | pending | ||
|
Founded in 1952 and headquartered in Rogers, Minnesota, Archway is a provider of marketing logistics, fulfillment services, and supply chain management solutions. |
||||||
| Ransomware | AutohausMalin id22853 View details | Austria | Retail / E-commerce | pending | ||
|
Since 1957, Autohaus Malin has been a proud partner of the Renault brand and, since 2006, a partner of the Dacia brand. Located in Sulz, Vorarlberg, they are known for reliability and customer friendliness, thanks to their competent team and many years of experience. |
||||||
| Ransomware | amsfulfillment.com id22567 View details | United States | Services | pending | ||
|
AMS Fulfillment is a leading full-service order fulfillment company operating as a third-party resource for order management, fulfillment center management and complex fulfillment services. AMS provides a full suite of fulfillment and distribution services to consumer products companies focused on serving the B2B retail (brick-and-mortar), online retail, and direct-to-consumer channels. |
||||||
| Ransomware | ellison-mills.com id22076 View details | United States | Communication / Marketing | pending | ||
|
Ellison-Mills Contracting is a family-oriented company specializing in wet utility and roadway infrastructure in Southern Arizona. They are committed to cultivating strong relationships with clients and team members while delivering quality construction management for various project types. With extensive experience in multimillion-dollar projects, the company prides itself on its ability to complete work on time and under budget across several contracting methods. |
||||||
| Ransomware | dafo.se id21974 View details | Sweden | Other | pending | ||
|
Dafo is a market leader in extinguishing systems for vehicles |
||||||
| Ransomware | Optima Tax Relief id20497 View details | United States | Services | pending | ||
|
Operating in the state of California, Optima Tax Relief LLC provides consulting services. The company also offers tax liability investigation and resolution, tax preparation and compliance, settlement and negotiation services. |
||||||
| Ransomware | Veethree id20466 View details | United States | IT | pending | ||
|
The Veethree Group is an alliance of companies, driven by common technologies and innovation. Today the group of companies has employees worldwide, with sites over 4 continents, serving 100’s of OEM customers. Those companies include: Indication Instruments Ltd – India Veethree New Zealand – New Zealand Veethree North America LLC – USA Veethree Electronics & Marine LLC – USA Veethree Technologies (CANtronik Ltd) – UK |
||||||
| Ransomware | Barnhartcrane.com id20463 View details | United States | Hospitality / Food & Beverage / Tourism | pending | ||
|
Started in 1969 and headquartered in Memphis, Tennessee, Barnhart is a heavy lift and heavy transport company. The company offers a variety of heavy lift and transport services across the United States, including operated crane rental, rigging services, component replacement solutions, industrial storage, and more |
||||||
| Ransomware | The Salvation Army id20286 View details | United States | Communication / Marketing | pending | ||
|
Data will be released soon. The Salvation Army, established in 1865, has been offering an array of social services that range from providing food for the hungry, relief for disaster victims, assistance for the disabled, outreach to the elderly and ill, clothing and shelter to the homeless and opportunities for underprivileged children. |
||||||
| Ransomware | iescomm.com id19172 View details | United States | Communication / Marketing | pending | ||
|
904.6 Million | Commercial & Residential Construction IES Communications, LLC (Integrated Electrical Services) We are the national leading provider of communications technology, systems, and services. IES Communications, LLC; The right team to get the job done |
||||||
| Ransomware | farmerbros.com id19053 View details | United States | Agriculture / Food | pending | ||
|
Food & Beverage | 341.1 Million Founded in 1912, Farmer Brothers is a national coffee roaster, wholesaler, equipment servicer and distributor of coffee, tea and culinary products. The companys product lines, include organic, Direct Trade and sustainably produced coffee. With a robust line of coffee, hot and iced teas, cappuccino mixes, spices and baking/biscuit mixes, Farmer Brothers delivers extensive beverage planning services and culinary products to its U.S.-based customers. It serves a wide variety of customers, from small independent restaurants and foodservice operators to large institutional buyers, such as restaurant, department and convenience store chains, hotels, casinos, healthcare facilities and gourmet coffee houses, as well as grocery chains with private brand coffee and consumer branded coffee and tea products, and foodservice distributors |
||||||
| Ransomware | goosehead.com id18865 View details | United States | Communication / Marketing | pending | ||
|
Goosehead Insurance, Inc. operates as a holding company for Goosehead Financial, LLC that engages in the provision of personal lines insurance agency services in the United States. The company offers homeowner's, automotive, dwelling property, flood, wind, earthquake, excess liability or umbrella, motorcycle, recreational vehicle, general liability, property, and life insurance products and services. The company was founded in 2003 and is headquartered in Westlake, Texas. |
||||||
| Ransomware | Pak Technologies id18864 View details | Pakistan | IT | pending | ||
|
PAK Technologies was established in 1980 in Milwaukee, WI. We began selling cleaners and restoration chemicals before incorporating private label blending and packaging. Since then, the company has grown and acquired BioPak, Inc., opened multiple facilities, and currently operates from its corporate headquarters and food processing facility located in Milwaukee. |
||||||
| Ransomware | Evans Distribution Systems id18863 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Founded in 1929, Evans Distribution Systems is a provider of complete supply chain solutions including transportation, warehousing, distribution, staffing, value-added packaging, quality inspection, and more. The company is headquartered in Melvindale, Michigan. |
||||||
| Ransomware | Transcore id18862 View details | United States | Communication / Marketing | pending | ||
|
Founded in 1939 and headquartered in Nashville, Tennessee, TransCore is a company that provides digital solutions and services to transportation departments and agencies around the world. The company provides solutions that aid in the development of express lanes, creating traffic systems, and managing vehicle-to-vehicle programs. |
||||||