Assessment: Chaos presents a high enterprise risk because the name now refers to two related but operationally distinct threat streams: the widely copied Chaos builder that emerged in 2021, and a newer ransomware-as-a-service operation observed from 2025. Early builder versions behaved partly as destructive wipers; later variants supported recoverable encryption. The newer operation conducts human-operated, double-extortion intrusions, combining data theft with encryption and pressure through
nas (3)
The UK’s National Cyber Security Centre (NCSC-UK) and allied cyber agencies are warning that China-linked actors are increasingly relying on vast proxy networks of hijacked consumer devices to conceal cyberattacks and evade detection. A new joint statement details how the threat actors now route malicious traffic through compromised routers, cameras, recorders, and network-attached storage (NAS) devices instead of using rented infrastructure. This method means attacks are harder to trace since
Cisco Talos researchers on 24 July 2025 detailed Chaos, a newer Ransomware-as-a-Service (RaaS) group that specializes in big company hunting and double extortion attacks (meaning it both encrypts victim files and steals data for potential leaking). According to Cisco Talos, the group emerged in early February 2025 and appears to be made up of former BlackSuit ransomware gang members "based on similarities in the ransomware's encryption methodology, ransom note structure, and the toolset used in
