chaos
ransomware group · aka Chaos, Cha0s, Chaos ransomware gang, Chaos ransomware group · unknown · active since 2021 (builder-era samples from mid-2021; leak-site extortion brand prominent since 2022)
Victims · 7d
5▲4 vs prev. week
Victims · 30d
12active targets
Victims · 90d
34
All-time (tracked)
91since 2025-03-31
Last post
09-14 16:49UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Chaos began in 2021 as a low-cost, builder-based Windows ransomware whose code was influenced by the older Dharma family; early builds were reportedly written in AutoIt with later versions in C/C++ (vendor research, 2021). A distinct 'Chaos' extortion brand operating a public leak site has been active since 2022 and became one of the more prolific name-and-shame posters, frequently listing small and mid-sized victims, sometimes in high volumes. In 2024, the FBI issued a FLASH advisory on Chaos ransomware, reflecting continued use of the strain against victims. Initial access is widely reported to rely on exposed remote-access services with weak or stolen credentials and phishing rather than a single exploited vulnerability. The group's country of origin, estimated earnings, and the precise relationship between the original builder family and the current leak-site brand are not definitively established (unknown).
Tactics & tooling
- Initial access via exposed RDP/VPN services with weak or stolen credentials (widely reported)
- Phishing-delivered ransomware and loader campaigns
- Dharma-influenced encryptor; partial encryption of large files
- Renames files with random names/extensions and drops a readme.txt ransom note (documented in early-family analyses)
- Deletes volume shadow copies to hinder recovery
- Cheap ransomware-as-a-service builder spawned many derivative builds, complicating attribution
- Data-theft extortion with public leak-site posts, sometimes mass-posting victims
Targeted sectors
varied; no consistent sector focus reportedsmall and mid-sized businesses commonly targetedmanufacturingbusiness servicesbiotechnology
Notable public victims
Cope Plastics (copeplastics.com; leak-site listing), Evergen (evergenbio.com; leak-site listing)
Estimated earnings
No public figure.
Leak-site victims91 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| glasfloss.com | · 1d ago | DATA LEAK NOTICE: GLASFLOSS (glasfloss.com) A comprehensive data breach has exposed 402 GB of confidential corporate, financial, and employee records from Glasfloss. The compromised database contains internal documentation across multiple departments: • Accounting & Finance: Contracts, ESOP rec… |
| steelhausinc.com | · 1d ago | Steelhaus boldly drives the market with innovative energy solutions; fusing practical, field proven experience, adaptable engineering, integrated manufacturing, and uncompromising safety with relentless delivery of unwavering customer service |
| mankatoclinic.com | · 5d ago | The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea… |
| artiflexmfg.com | · 5d ago | ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica… |
| copeplastics.com | · 6d ago | Cope Plastics is a leading U.S. distributor and fabricator of performance plastics, serving industrial and commercial customers since 1946. From our headquarters in Alton, Illinois and through multiple branch locations, we support clients across countless sectorsheavy equipment, transportation, aero… |
| evergenbio.com | · 9d ago | Evergen is a leading Contract Development and Manufacturing Organization (CDMO) specializing in biomaterial solutions for regenerative medicine. We work closely with OEM partners to deliver customized biomaterial solutions that meet specific clinical needs |
| corematerials.com | · 18d ago | Core Materials (corematerials.com) — Countdown to Publication Management at Core Materials has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are m… |
| macallister.com | · 18d ago | MacAllister (macallister.com) — Countdown to Publication Management at MacAllister has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving fo… |
| singleton.com | · 18d ago | Founded in 1986, Singleton Reynolds is a law firm. They are headquartered in Vancouver, British Columbia. |
| parkderochie.com | · 21d ago | Park de Rochie (parkderochie.com) – Countdown to Publication Management at Park de Rochie has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are mo… |
| mswalker.com | · 21d ago | MS Walker (mswalker.com) – Countdown to Publication Management at MS Walker has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving forward o… |
| copcp.com | · 21d ago | Central Ohio Primary Care (copcp.com) – Countdown to Publication Management at Central Ohio Primary Care has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to en… |
| tomorrowsoffice.com | · Aug 5, 2026 | URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office (tomorrowsoffice.com) Status: Ongoing Data Publication Countdown Security researchers have successfully exfiltrated 125 GB of critical and confidential data from the internal infrastructure of Tomorrow’s Office (tomorrowsoff… |
| healthcarehighways.com | · Aug 5, 2026 | WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcarehighways.com) Countdown: 24 Hours If corporate representatives do not establish contact via chat within the next 24 hours, a massive internal data cache comprising 235 GB of sensitive company and client records will be p… |
| thecranewaregroup.com | · Jul 28, 2026 | Craneware’s Public Deception: The Reality Behind the 'Non-Sensitive' Data Breach Recent public statements and regulatory filings by UK health-tech firm Craneware claim that the massive cyber-attack they suffered only exposed "non-sensitive or already public regulatory data." They would have the s… |
| vit-best.com | · Jul 27, 2026 | DATA BREACH NOTICE: VIT-BEST.COM Status: The first 3% of the total data (100%) has been published Countdown: 48 hours until the remaining 97% is published Situation Overview We have successfully breached VIT-BEST’s infrastructure and extracted a complete set of critical data. At this t… |
| remco.ca | · Jul 26, 2026 | Founded in 1977 and headquartered in Quebec, Canada, Remco is an industry leader in warehousing, transportation and country-wide distribution for the retail industry |
| neopharmlabs.com | · Jul 22, 2026 | Notice of Data Escalation: 3% Proof Publication Management is ignoring the seriousness of the situation and refusing to engage in dialogue. We are publishing a 3% sample of our 627 GB archive right now. We are giving management 48 hours to reach out to us. If they fail to contact us within this ti… |
| issvc.com | · Jul 22, 2026 | issvc.com Official Notice to Management and Stakeholders The time window has expired. Exactly 24 hours remain until the final deadline. If an agreement is not reached by the end of this period, the complete confidential dataset totaling 262 GB will be published into the public domain. Compromised… |
| argonautms.com | · Jul 22, 2026 | Target Organization: argonautms.com (Argonaut Manufacturing Services) Status: Unauthorized Access & Data Exfiltration Confirmed Volume: 295 GB of Critical Corporate, Technical & Operational Data Countdown: 48 Hours to establish contact before public release. Executive Summary The internal infras… |
| wikoff.com | · Jul 20, 2026 | [PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Data Volume: 650 GB Status: Full Compromise Confirmed We are officially confirming that the entire internal infrastructure of Wikoff Color Corporation—ranging from Board of Directors financial reports and proprietary R&D formulas… |
| radiax.com | · Jul 16, 2026 | NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that we have gained full access to the internal network and sensitive data infrastructure of Radiax.com. To prove the authenticity of our access, we have published an initial 5% of the total exfiltrated data. This is merely a sample. W… |
| sleemanbreweries.ca | · Jul 14, 2026 | Sleeman Breweries was founded in 1851 and headquartered in Guelph, Ontario. The company now markets and distributes world-class domestic and imported products. |
| spectrumchemical.com | · Jul 14, 2026 | Public Notice: Final Ultimatum to Spectrum Chemical Management To the Management of Spectrum Chemical: We have provided you with sufficient time to engage in a productive dialogue regarding the security breach of your infrastructure. Your refusal to communicate and your attempt to ignore the sever… |
| aphenapharma.com | · Jul 14, 2026 | Aphena Pharma Solutions We have gained full access to your corporate infrastructure. During this operation, we stole 142 GB of your most critical corporate data. The stolen data includes: Financial statements: capital expenditures (CAPEX), fixed assets, accounts receivable and accounts payabl… |
| corepharma.com | · Jul 8, 2026 | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are officially announcing that our security team has successfully breached the internal network of CorePharma. We are currently in possession of a comprehensive archive of the company’s internal operations, including sensitive regu… |
| opportune.com | · Jul 8, 2026 | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are officially announcing that our security team has successfully breached the internal network of Opportune LLP. As of this moment, we are in possession of the entire Opportune internal data environment—an massive archive containi… |
| gisy.com | · Jul 6, 2026 | Target: Gisy.com Status: Data Exfiltration Confirmed Volume: 1.1 TB (341,712 files) Deadline: 24 Hours We have successfully exfiltrated 1.1 Terabytes of internal data from Global Industries’ (gisy.com) primary network servers. This archive contains comprehensive documentation covering every layer… |
| aircreebec.ca | · Jul 6, 2026 | Air Creebec, founded in 1982, is a regional airline company based Waskaganish, Quebec. The company provides regular flights, air charter, medical transportation, and cargo services. |
| universalplant.com | · Jun 30, 2026 | FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of 315 GB of your corporate, financial, and operational data. Our analysis confirms that this archive contains highly sensitive information, including: Financial & Accounting: Full audits, tax filings (ADP), payroll, bank transa… |
| ingerman.com | · Jun 26, 2026 | Ingerman is a developer, builder and manager of multifamily housing communities throughout the Mid-Atlantic region. |
| roofdepot.com | · Jun 25, 2026 | Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a roofing manufacturer that specializes in roof installation, repairs & replacement |
| randa.net | · Jun 23, 2026 | Randa Apparel & Accessories is a global powerhouse and one of the world's leading apparel and lifestyle accessories companies, headquartered in New York City at 417 Fifth Avenue, 11th Floor. Founded in 1910, with the founder's family having been in the neckwear business since that time and the curre… |
| graymont.com | · Jun 22, 2026 | NOTICE: Graymont – Final Warning We have successfully gained full access to the corporate infrastructure of Graymont. Our team currently holds a massive volume of highly sensitive data. The scope of our access covers the entire core of your operations, from executive financial strategy to individ… |
| airespring.com | · Jun 9, 2026 | Founded in 2001, AireSpring is a Managed Services Provider specializing in Unified Communications, Managed Network, and IT Services, serving thousands of businesses nationwide. AireSpring provides fully managed and connected end-to-end, next-generation solutions for multi-location enterprise custome… |
| entransinternational.com | · May 28, 2026 | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Entrans International (entransinternational.com) THE REALITY OF ENTRANS INTERNATIONAL We have been in possession of your internal data for some time. Throughout this period, we have attempted to engage with your management, but their si… |
| powerhousenow.com | · May 28, 2026 | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Powerhouse (powerhousenow.com) THE REALITY OF POWERHOUSE We have been in possession of your internal data for some time. We have attempted to engage with your management to resolve this incident professionally, but their silence speaks… |
| sterlingindustries.com | · May 27, 2026 | STERLING INDUSTRIES: FINAL NOTICE BEFORE FULL RELEASE STATUS: PENDING FINAL PUBLICATION ENTITY: Sterling Industries (sterlingindustries.com) LEAK SIZE: ~503 GB ATTENTION MANAGEMENT We are currently in the final stages of preparing your data for public release. We have provided you with ample time… |
| wtitransport.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. WTI Transport is a flatbed trucking company headquartered… |
| cstindustries.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. Founded in 1893, CST is a manufacturer and construction co… |
| fallprotect.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. Diversified Fall Protection specializes in the design, fab… |
| challenge-mfg.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. Challenge Manufacturing is a leading Tier 1 automotive sup… |
| vacaero.com | · May 4, 2026 | If the company's management does not reach an agreement with us within 4 days, we will publish 250 GB of the company's internal data. Founded in 1959, VAC AERO provides vacuum heat treating and thermal & paint coating services as well as vacuum furnace systems and controls to aerospace and high-tec… |
| www.cswindustrials.com | · May 4, 2026 | If the company's management does not contact us within 24 hours, we will publish 540 GB of the company's internal files. CSW Industrials, Inc. is a diversified industrial growth company that operates across contractor solutions, specialized reliability solutions, and engineered building solutions.… |
| cadencepetroleum.com | · Apr 28, 2026 | Company management has 48 hours to reach an agreement with us. If no agreement is reached, the files—totaling 400 GB—will be published. Our objective is to provide our customers with the best products and services. Cadence Petroleum and our suppliers stand behind the products we offer. Regardle… |
| alexandergroup.com | · Apr 22, 2026 | The company is disregarding its customers' data. If a deal is not reached within 48 hours, the files will be made public. The Alexander Group is a revenue growth and sales management consulting company. It is headquartered in Scottsdale, Arizona |
| polycorp.com | · Apr 20, 2026 | If the company does not contact us within 48 hours, the files will be published. Polycorp is a privately owned Canadian Company that specializes in the design and manufacture of engineered elastomeric parts that provide our customers with cost effective solutions to their corrosion, abrasion, impac… |
| coastappliances.com | · Apr 14, 2026 | It offers refrigerators, freezers, wall ovens, washers, and electric ranges. |
| itc-group.com | · Apr 14, 2026 | Founded in 1983, ITC Construction Group is a Commercial and Residential Construction company that specializes in residential high rises, mixed-use developments, and select commercial projects. |
| kdmpop.com | · Mar 24, 2026 | FINAL WARNING: KDM P.O.P. SOLUTIONS STATUS: PRE-RELEASE (48 HOURS REMAINING) DATA VOLUME: 600 GB ARCHIVE Negotiations are on the verge of collapse due to management negligence. ULTIMATUM: The company has 48 HOURS to reach an agreement. If the timer reaches zero, 600 GB of corporate secrets and… |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .