Ransomware group
Chaos ransomware: victims and leak site activity
The Chaos ransomware group has listed 96 victims on its leak site since March 2025; its latest post is from 9 October 2026. Most affected countries: United States, United Kingdom and Canada. Most targeted sector: Manufacturing.
Total posts
96
First seen
2025-03-31
Latest post
2026-10-09
Countries hit
16
About Chaos
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
- Leak site (Tor)
- http://hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onion
- Profile
- ransomware.live
Most targeted countries
- United States 67
- United Kingdom 6
- Canada 4
- Germany 4
- Australia 2
- Russia 2
- Austria 1
- China 1
- Italy 1
- Mexico 1
Most targeted sectors
- Manufacturing 19
- Technology 19
- Professional Services 15
- Healthcare 10
- Financial Services 6
- Transportation 6
- Retail & E-Commerce 5
- Agriculture and Food Production 3
- Energy & Utilities 2
- Hospitality 2