MalwarePublished 29 Aug 2025Updated 28 Sep 2025

Unmasking the new Chaos RaaS group attacks

Source AlienVault OTX General

Description

Cisco Talos Incident Response has observed attacks by Chaos, a new ransomware-as-a-service group conducting big-game hunting and double extortion attacks. The group uses spam flooding, voice-based social engineering, RMM tool abuse, and legitimate file-sharing software for data exfiltration. Their ransomware employs multi-threaded rapid selective encryption and anti-analysis techniques, targeting both local and network resources. Chaos is likely formed by former BlackSuit (Royal) gang members, based on similarities in encryption methodology, ransom note structure, and toolset. The group has impacted various business verticals, predominantly in the U.S., UK, New Zealand, and India. They use the '.chaos' file extension and demand ransoms around $300K, threatening data disclosure and DDoS attacks if not paid.

Impact

For European organizations, the Chaos ransomware group poses a significant risk due to its targeted big-game hunting approach and double extortion tactics. The potential impacts include severe operational disruption from rapid encryption of critical local and networked data, financial losses from ransom payments averaging around $300,000, and reputational damage stemming from threatened or actual data leaks. The use of legitimate file-sharing tools for exfiltration complicates detection and response efforts, increasing the likelihood of sensitive data exposure under GDPR regulations, which could lead to substantial regulatory fines and legal consequences. The threat of follow-up DDoS attacks further exacerbates availability risks, potentially impacting online services and customer-facing platforms. European businesses with remote management infrastructure or those relying on third-party RMM tools are particularly vulnerable. The multi-threaded encryption and anti-analysis features suggest that once inside a network, Chaos ransomware can quickly propagate and evade traditional defenses, making incident response more challenging. The medium severity rating reflects the combination of high ransom demands and sophisticated attack methods balanced against the current geographic focus and lack of known widespread exploits in the wild.

Defensive guidance

European organizations should implement a layered defense strategy tailored to the specific tactics employed by Chaos ransomware. Key measures include: 1) Enhancing email security to detect and block spam flooding campaigns and phishing attempts, including advanced anti-spam filters and user awareness training focused on voice-based social engineering threats. 2) Strictly controlling and monitoring RMM tool usage by enforcing least privilege principles, multi-factor authentication (MFA), and logging all remote access sessions for anomaly detection. 3) Deploying network segmentation to limit lateral movement and restrict access to sensitive data repositories. 4) Monitoring and restricting the use of legitimate file-sharing software, employing data loss prevention (DLP) solutions to detect unauthorized data exfiltration. 5) Utilizing endpoint detection and response (EDR) tools capable of identifying multi-threaded encryption behavior and anti-analysis techniques. 6) Maintaining up-to-date backups with offline or immutable storage to enable rapid recovery without paying ransom. 7) Conducting regular threat hunting and incident response exercises simulating Chaos ransomware scenarios. 8) Collaborating with threat intelligence sharing platforms to stay informed about emerging indicators and tactics. These targeted controls go beyond generic advice by addressing the specific operational methods of the Chaos group.

Indicators of compromise

IP addresses 3

45.61.134.36CC=US ASN=AS46261 quickpacket llc
107.170.35.225CC=US ASN=AS14061 digitalocean llc
144.172.103.42CC=US ASN=AS53667 frantech solutions

Hashes 9

160f60dc3fc9920cfc3847de4de2ef09MD5 of 7c4b465159e1c7dbbe67f0eeb3f58de1caba293999a49843a0818480f05be14e
87fd821b67a1f329548f222d81a55be7MD5 of 1d846592ffcc19ed03a34316520aa31369218a88afa4e17ac547686d0348aa5b
9113f4b245da32c75d61b467ee89e0b7MD5 of 11cfea4100ba3731d859148d2011c7225d337db22797f7e111c0f2876e986490
21f974f224cef8bcaa194bed75f25ee28e1ca8d4SHA1 of 1d846592ffcc19ed03a34316520aa31369218a88afa4e17ac547686d0348aa5b
34a45f4172a355bf532185a83d0dd55df9794e91SHA1 of 11cfea4100ba3731d859148d2011c7225d337db22797f7e111c0f2876e986490
bb73d57a43b27c11baf6f221ad17c0a83a08f752SHA1 of 7c4b465159e1c7dbbe67f0eeb3f58de1caba293999a49843a0818480f05be14e
11cfea4100ba3731d859148d2011c7225d337db22797f7e111c0f2876e986490
1d846592ffcc19ed03a34316520aa31369218a88afa4e17ac547686d0348aa5b
7c4b465159e1c7dbbe67f0eeb3f58de1caba293999a49843a0818480f05be14e

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Aug 2025, 15:33 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

IP addresses 3

Hashes 9

Community reviews

Related threats