Description
Chaos is ransomware and backdoor malware written for the .NET framework that targets Windows systems for file encryption and remote access, with variants extending to Linux. Its widely shared builder has allowed cyberattackers to produce many customized variants, each configuring extensions, ransom notes, and anti analysis checks differently. Most campaigns distribute it through phishing emails and loaders, and the family's accessibility has made it a common tool for low skilled operators.
Stats
- First seen
- April 2022
- Last seen
- October 2026
MITRE ATT&CK techniques
5 techniques across 4 tactics.
Alert name variants
| Alert Name |
|---|
| ByteCode-MSIL.Ransomware.Chaos |
| Document-Word.Virus.Chaos |
| Gen:Variant.Linux.Chaos.1 |
| Gen:Variant.Ransom.Chaos.107 |
| Gen:Variant.Ransom.Chaos.148 |
| Gen:Variant.Ransom.Chaos.215 |
| Gen:Variant.Ransom.Chaos.30 |
| Gen:Variant.Ransom.Chaos.37 |
| Gen:Variant.Ransom.Chaos.45 |
| Gen:Variant.Ransom.Chaos.6 |
