Chaos Ransomware Evolves from Crude Wiper to DIY Destruction Toolkit

The report examines the Chaos operation—a ransomware builder that initially functioned as a wiper and later evolved into the Yashma ransomware family with genuine encryption and persistence. By packaging destructive capabilities into a configurable builder sold on Russian-language forums, Chaos lowered the bar for low-skill attackers and enabled widespread opportunistic attacks against under-resourced targets (schools, small businesses, local governments). The analysis highlights the operation's shift from indiscriminate destruction to more traditional extortion, the challenges it poses to signature-based defenses, and the broader trend toward destructive extortion.