🏹 chaos — Ransomware
Chaos is a ransomware-as-a-service operation that emerged in early 2025, likely formed by former BlackSuit/Royal members, offering cross-platform ransomware for Windows, Linux, ESXi, and NAS to affiliates recruited on the RAMP dark web forum, excluding CIS/BRICS countries and hospitals from targeting.
Classification
Ransomware
Leak-site victims
79
Ransomware.live
Associated IoCs
0
local intel
MITRE techniques
—
ATT&CK
Tracked
Yes
Ransomware.live
🔥 Leak-Site Victims (79)
| Victim | Country | Published | Domain |
|---|---|---|---|
| tomorrowsoffice.com | GB | 2026-08-05T16:23:51.684617+00:00 | tomorrowsoffice.com |
| healthcarehighways.com | US | 2026-08-04T15:57:20.837403+00:00 | healthcarehighways.com |
| thecranewaregroup.com | GB | 2026-07-28T16:53:00.355142+00:00 | thecranewaregroup.com |
| vit-best.com | RU | 2026-07-27T18:51:52.889346+00:00 | vit-best.com |
| remco.ca | CA | 2026-07-26T15:22:10.355806+00:00 | remco.ca |
| neopharmlabs.com | US | 2026-07-22T16:53:09.341272+00:00 | neopharmlabs.com |
| issvc.com | US | 2026-07-22T08:58:05.736397+00:00 | issvc.com |
| argonautms.com | RU | 2026-07-21T17:57:41.180759+00:00 | argonautms.com |
| wikoff.com | US | 2026-07-20T09:26:56.801434+00:00 | wikoff.com |
| radiax.com | US | 2026-07-16T17:22:01.618290+00:00 | radiax.com |
| spectrumchemical.com | US | 2026-07-14T20:22:34.626266+00:00 | spectrumchemical.com |
| aphenapharma.com | US | 2026-07-14T15:23:06.966353+00:00 | aphenapharma.com |
| opportune.com | US | 2026-07-08T07:22:55.747703+00:00 | opportune.com |
| corepharma.com | US | 2026-07-08T07:22:23.304277+00:00 | corepharma.com |
| gisy.com | US | 2026-07-06T19:22:30.538831+00:00 | gisy.com |
| aircreebec.ca | CA | 2026-07-06T16:51:47.571751+00:00 | aircreebec.ca |
| universalplant.com | US | 2026-06-30T16:54:50.260413+00:00 | universalplant.com |
| ingerman.com | DE | 2026-06-26T09:24:16.055980+00:00 | ingerman.com |
| roofdepot.com | US | 2026-06-25T15:46:31.165632+00:00 | roofdepot.com |
| randa.net | 2026-06-23T05:20:58.867277+00:00 | www.randa.net | |
| graymont.com | CA | 2026-06-22T20:21:48.555322+00:00 | graymont.com |
| sleemanbreweries.ca | CA | 2026-07-14T20:23:10.017073+00:00 | sleemanbreweries.ca |
| airespring.com | US | 2026-06-09T16:21:00.323441+00:00 | airespring.com |
| entransinternational.com | US | 2026-05-28T21:21:02.817352+00:00 | entransinternational.com |
| sterlingindustries.com | US | 2026-05-27T20:51:58.392771+00:00 | sterlingindustries.com |
| challenge-mfg.com | US | 2026-05-17T19:52:16.001018+00:00 | challenge-mfg.com |
| wtitransport.com | DE | 2026-05-17T19:51:51.325860+00:00 | www.wtitransport.com |
| cstindustries.com | US | 2026-05-17T19:51:24.632468+00:00 | cstindustries.com |
| fallprotect.com | US | 2026-05-17T19:50:58.947759+00:00 | www.fallprotect.com |
| vacaero.com | MX | 2026-05-04T17:51:21.145196+00:00 | vacaero.com |
| www.cswindustrials.com | US | 2026-05-04T17:51:02.208940+00:00 | www.cswindustrials.com |
| cadencepetroleum.com | US | 2026-04-28T20:51:15.316406+00:00 | cadencepetroleum.com |
| coastappliances.com | US | 2026-04-14T16:50:03.110859+00:00 | www.coastappliances.com |
| itc-group.com | DE | 2026-04-14T16:49:25.694144+00:00 | www.itc-group.com |
| kdmpop.com | US | 2026-03-27T21:05:22.333071+00:00 | www.kdmpop.com |
| flad.com | US | 2026-03-12T16:52:29.959172+00:00 | flad.com |
| milespartnership.com | US | 2026-02-26T08:32:39.312002+00:00 | milespartnership.com |
| nelsonworldwide.com | US | 2026-03-06T20:34:14.317693+00:00 | www.nelsonworldwide.com |
| ntic.com | US | 2026-02-26T17:24:54.178626+00:00 | ntic.com |
| horizonmedia.com | US | 2026-02-09T17:21:34.820335+00:00 | horizonmedia.com |
| CEIVA Logic | US | 2026-01-05T17:41:47.262207+00:00 | www.ceiva.com |
| VEPLASTIC | IT | 2025-12-26T11:48:53.770471+00:00 | www.veplastic.com |
| NSE Insurance Agencies | US | 2025-12-11T02:09:48.666128+00:00 | www.nseinsurance.com |
| b2be.com | MY | 2025-12-08T21:10:21.067862+00:00 | www.b2be.com |
| thinkmarkets.com | AU | 2025-12-08T20:51:09.809501+00:00 | www.thinkmarkets.com |
| lesker.com | US | 2025-12-02T20:51:28.100449+00:00 | www.lesker.com |
| dakkota.com | US | 2025-12-02T17:09:38.062453+00:00 | dakkota.com |
| mToilet | PL | 2025-11-23T19:44:57.785964+00:00 | www.mtoilet.pl |
| Metropolitan Adjustment Bureau | US | 2025-11-13T22:43:04.030208+00:00 | www.metroadjusters.com |
| iconinternational.com | US | 2025-11-12T19:42:20.415171+00:00 | www.iconinternational.com |
| DeCeTe | DE | 2025-10-28T02:10:34.767464+00:00 | decete.de |
| ebaengineering.com | US | 2025-10-07T21:20:41.907764+00:00 | www.ebaengineering.com |
| indiesemi.com | US | 2025-10-07T19:51:06.189793+00:00 | www.indiesemi.com |
| archway.com | US | 2025-10-07T14:11:40.807366+00:00 | www.archway.com |
| AutohausMalin | AT | 2025-10-07T09:55:14.672748+00:00 | autohaus-malin.at |
| amsfulfillment.com | US | 2025-09-24T20:48:51.946406+00:00 | www.amsfulfillment.com |
| ellison-mills.com | US | 2025-09-01T18:38:30.863226+00:00 | ellison-mills.com |
| dafo.se | SE | 2025-08-27T09:03:48.308168+00:00 | www.dafo.se |
| Veethree | US | 2025-06-05T20:23:13.718401+00:00 | veethree.com |
| The Salvation Army | US | 2025-05-27T21:54:09.514697+00:00 | www.salvationarmy.org |
| Optima Tax Relief | US | 2025-06-06T17:07:16.419026+00:00 | optimataxrelief.com |
| Pak Technologies | PK | 2025-03-31T18:30:14.840711+00:00 | paktech.com |
| Evans Distribution Systems | US | 2025-03-31T18:28:47.245742+00:00 | evansdist.com |
| Transcore | US | 2025-03-31T18:26:04.573673+00:00 | transcore.com |
| farmerbros.com | US | 2025-04-08T20:14:04.181165+00:00 | farmerbros.com |
| goosehead.com | US | 2025-03-31T18:31:23.783552+00:00 | goosehead.com |
| iescomm.com | US | 2025-04-15T16:55:26.485847+00:00 | iescomm.com |
| www.rocketstores.com | US | 2025-10-07T19:51:25.176219+00:00 | www.rocketstores.com |
| alexandergroup.com | US | 2026-04-22T21:28:12.025042+00:00 | alexandergroup.com |
| polycorp.com | GB | 2026-04-20T22:05:37.001031+00:00 | polycorp.com |
| smythco.com | US | 2026-03-20T20:01:07.207414+00:00 | smythco.com |
| loopcap.com | US | 2026-03-18T17:32:11.100205+00:00 | loopcap.com |
| crescentenergyco.com | US | 2026-03-07T13:02:42.696348+00:00 | crescentenergyco.com |
| anomatic.com | US | 2026-01-29T16:31:06.289113+00:00 | anomatic.com |
| amsino.com | US | 2025-12-24T10:17:41.095280+00:00 | amsino.com |
| hanson-inc.com | US | 2025-10-24T20:47:34.037364+00:00 | hanson-inc.com |
| www.msssolutions.com | US | 2025-10-09T15:41:43.030499+00:00 | www.msssolutions.com |
| Barnhartcrane.com | US | 2025-06-05T17:21:02.200770+00:00 | barnhartcrane.com |
| powerhousenow.com | US | 2026-05-28T21:51:47.841457+00:00 | powerhousenow.com |
Source: Ransomware.live leak-site monitoring (cached, offline-safe).
📁 Case Management
🏹 Campaigns & malware
🏹 Add to case
🧩 Advanced Capabilities
Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron