Unmasking the new Chaos RaaS group attacks

Cisco Talos describes a newly observed RaaS group called "Chaos" conducting big-game hunting double-extortion ransomware attacks across Windows, ESXi, Linux, and NAS systems using social-engineering (including vishing), RMM tool abuse, legitimate file-syncing tools for exfiltration, and a multi-threaded selective-encryptor that appends ".chaos" and deploys a ransom note. The report provides technical analysis of the encryptor (Curve25519 ECDH, AES-256, anti-analysis, shadow copy deletion, selective offset encryption), detailed TTP mappings (MITRE ATT&CK), IOCs, mitigation guidance, and assesses a likely link to BlackSuit/Royal actors.