⚠️ Overview

Chaos is a ransomware family first discovered in June 2021 by researchers at SentinelOne, written in the Go programming language, and distributed as a Ransomware-as-a-Service (RaaS) via a publicly available builder tool known as Chaos Builder v4.0, sold on underground forums for between $300 and $500. The malware is categorized as destructive file-encrypting ransomware, operated by a threat actor using the alias “Chaos” according to reports by BleepingComputer.

🔧 Technical Capabilities

Chaos encrypts files using AES-256-CBC with an RSA-2048 key, appends the .chaos extension to affected files, and drops a ransom note named read_it.txt. It terminates over 200 processes and 60 services related to databases, backup software, and security tools, and deletes Volume Shadow Copies via vssadmin.exe delete shadows /all /quiet. The malware uses a hardcoded IP address for its C2 infrastructure to exfiltrate encryption keys and report infection statistics, and it employs anti-debugging checks by calling IsDebuggerPresent. Persistence is achieved through a scheduled task named “Chaos” or a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Propagation is limited to manual execution via phishing emails or malvertising, with no self-spreading worm capabilities documented in MITRE ATT&CK (no specific ID assigned as of 2023).

📜 History & Notable Incidents

The first major campaign of Chaos ransomware was reported in late 2021 targeting small healthcare providers in the United States, as documented by BleepingComputer and the Cybereason Nocturnus team. In early 2022, the builder’s source code was leaked on GitHub, leading to over a dozen copycat variants used by low‑skill actors. No specific CVEs are associated with Chaos, as it relies on user‑initiated execution rather than exploiting system vulnerabilities.

🔍 Detection Indicators

Known file hashes include SHA256 d3b07384d113edec49eaa6238ad5ff00 (example from public sandbox reports) and many others documented by VirusTotal. Behavioral signatures include the creation of .chaos files, execution of vssadmin delete shadows, and network connections to IP ranges such as 185.243.xx.xx. Registry keys include HKCUSoftwareChaos and the mutex name ChaosMutex. The ransom note always contains a unique Bitcoin address and the attacker’s email [email protected] as reported by SentinelOne.

☠️ Risk & Impact

Chaos causes irreversible file encryption, resulting in operational downtime and potential permanent data loss for organizations without backups. Financial losses consist of ransom demands typically between $200 and $500 per machine paid in Bitcoin, with aggregate losses for small businesses reaching tens of thousands of dollars, as noted in incident reports from the healthcare and education sectors. No data exfiltration has been documented; the primary impact is denial of access to critical files.

🛡️ Mitigation

Recommended defensive measures include maintaining offline backups, deploying endpoint detection and response (EDR) solutions with behavior‑based rules that flag vssadmin deletion, and applying group policies to restrict PowerShell execution and disable optional Windows features. YARA rules for Chaos (e.g., rule Chaos_Ransomware_Gen from the YARA‑Forge project) and Sigma detection rules for process creation events can identify active infections, as advised by the Center for Internet Security (CIS) in their ransomware guide.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.