Ransomware group
Chaos ransomware: victims and leak site activity
The Chaos ransomware group has listed 87 victims on its leak site since March 2025; its latest post is from 8 September 2026. Most affected countries: United States, United Kingdom and Canada. Most targeted sector: Technology.
Total posts
87
First seen
2025-03-31
Latest post
2026-09-08
Countries hit
15
About Chaos
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Most targeted countries
- United States 60
- United Kingdom 5
- Canada 4
- Germany 4
- Australia 2
- Russia 2
- Austria 1
- China 1
- Italy 1
- Mexico 1
Most targeted sectors
- Technology 19
- Manufacturing 15
- Professional Services 14
- Financial Services 6
- Healthcare 6
- Transportation 6
- Retail & E-Commerce 5
- Agriculture and Food Production 3
- Energy & Utilities 2
- Hospitality 2