chaos

Chaos is a ransomware group that gains initial access through social engineering and remote-access campaigns, then deploys ransomware using a modular toolset that includes a custom loader and backdoor; notable tradecraft includes a Rust-based remote access trojan (msaRAT) that disguises C2 traffic within legitimate browser activity. 81 victims have been claimed, with the sectors most affected Technology, Business Services, Manufacturing, Financial Services, and Healthcare, and the countries most affected the United States, Germany, Canada, the United Kingdom, and Australia. As illustrated by the 2026-07-29 report, a vishing campaign using Microsoft Teams to impersonate IT personnel gained remote access and led to subsequent ransomware deployment. The reporting also shows a pattern of evolving tradecraft to evade detection, such as using msaRAT to conceal C2 traffic by blending it with browser activity.

Sectors: Technology, Business Services, Manufacturing · Countries: US, GB, DE