Chaos Ransomware Decryption & Data Recovery

Chaos was first observed in February 2025, advertising its cross-platform encryptor and recruiting affiliates on the Russian-language RAMP forum, and supplying builds for Windows, Linux, ESXi and NAS plus a victim-management panel - a textbook ransomware-as-a-service model. Cisco Talos assessed with moderate confidence that the crew is either a rebranding of BlackSuit (Royal) or operated by some of its former members, citing similarity in encryption parameters, note structure and tooling; the brand became busy after an international law-enforcement operation seized BlackSuit infrastructure on 24 July 2025. Vendors differ on the start date: Talos records first observation in February 2025 while others describe Chaos as forming only after that takedown; this page follows the Talos timeline.

The naming collision has to be settled first. This Chaos is not the 2021 Chaos ransomware builder behind Yashma and Chaos-C++; Talos notes the actors exploited the confusion around the name to obscure their identity. A leak site calling itself Trinity of Chaos is yet another distinct entity. The name alone identifies nothing.

Public leak-site aggregators list roughly 89 named organisations since February 2025, about 62 of them in the United States, with posts continuing into September 2026 - a count that moves over time. Sectors cluster in manufacturing, professional services, energy and construction. The RaaS rules claim the crew avoids BRICS and CIS countries, hospitals and government - a unilateral statement only. Rapid7 also documented, in May 2026, an operation borrowing the Chaos brand as a false flag, linked with moderate confidence to an Iranian state-aligned APT, which stole data without encrypting.

Extension and note. The .chaos suffix is appended to the original filename, so report.xlsx becomes report.xlsx.chaos. README.chaos.txt appears in affected directories, usually lowercase on Linux and ESXi. The English text frames the attack as a "security test", gives a victim-specific .onion registration and negotiation address, an ID and a support mailbox, and threatens publication, DDoS against internet-facing services, and spreading news of the breach to competitors and clients. Talos documented one demand of roughly $300,000.

Intrusion-side artefacts, which usually predate the note:

• Spam email flooding, followed by a phone call or an external Microsoft Teams chat and voice call from someone claiming to be IT support.
• Unexpected installs of remote assistance and RMM software: Quick Assist, RemSupp, AnyDesk, DWAgent, ScreenConnect.
• GoodSync used as a bulk exfiltration channel.
• Shadow copy deletion via vssadmin, Kerberoasting, Impacket executing commands over SMB, outbound reverse SSH tunnels.

A decisive branch. If a note exists but nothing is actually encrypted, treat the case as brand impersonation: hunt for long-dwell access and tampered MFA settings rather than starting a recovery workflow.

Chaos barely relies on exploits; people are the entry point:

• Email flooding plus voice phishing. The target's mailbox is swamped with spam, then someone posing as the IT service desk calls or opens an external Microsoft Teams chat, offering to fix the mail problem and walking the user into a Quick Assist or RemSupp session. The STAC4749 cluster Sophos tracked hit dozens of organisations between February and June 2026, roughly 95% of them in North America, split about evenly between Canada and the United States.
• RMM persistence. The first session installs commercial remote-control and RMM software - AnyDesk, DWAgent, ScreenConnect - and enables RDP, so removing one tool does not cut access.
• Credential access and lateral movement. Kerberoasting for service account tickets, then Impacket executing commands over SMB, plus RDP and reverse SSH, with the domain controller as the objective.
• Exfiltration and deployment. GoodSync moves data out; the encryptor is then pushed over SMB and admin shares to endpoints, servers and hypervisors, detonating at once.

Speed is what makes this crew dangerous: in one Sophos case fewer than 17 hours separated the first Teams contact from estate-wide encryption, so controls have to sit on the vishing and remote-tool steps.

Algorithms. File contents are encrypted with AES-256 and each per-file key is protected by elliptic-curve key agreement; Talos documents Curve25519 ECDH. Key material is never written in cleartext and no exploitable flaw has been published. A few second-hand write-ups describe the key wrapping differently from Talos, so the reversed sample from the incident decides.

Configurable intermittent encryption. An /encrypt_step parameter sets what percentage of each file is encrypted, from 0 to 100, defaulting to 30. This is the single most important fact for a recoverability assessment: at the default, roughly seventy percent of a large file is untouched, but repairability depends on whether the overwritten regions include the header or the database page directory, so it must be measured.

Other runtime parameters. /lkey supplies the encryption key, /work_mode sets the scope (local, network or both), /ignorar_arquivos_grandes governs handling of very large files, and /kill_vms stops virtual machines before encryption. A recovered command line is direct evidence of the scope and intensity of this particular run.

Reach and recovery inhibition. The encryptor is multithreaded and enumerates and queues local disks alongside reachable network shares, so NAS devices and file servers are commonly encrypted in the same pass. It deletes volume shadow copies via vssadmin, and the ESXi/Linux builds stop virtual machines before encrypting vmdk and similar virtual disks.

Triple extortion. Non-payment leads to staged publication, DDoS against internet-facing services, and threats to spread news of the breach to clients and competitors. DDoS is stated explicitly in the note, so declining to negotiate has to be paired with availability protection, not only restore planning.