Threat Actor
Chaos
0
indicators on this record
Properties
- Summary
- Used the msaRAT Rust implant to route ransomware command-and-control traffic through the victim's own headless Chrome or Edge browser instance.
- First seen
- 2026-07-27T04:00:26.959997+00:00
- Last seen
- 2026-07-27T04:00:26.959997+00:00
- Created at
- 2026-07-27T04:00:26.959997+00:00
- Mention count
- 1
- Evidence url
- https://thehackernews.com/2026/07/chaos-ransomware-uses-msarat-to-route.html
- Resolution basis
- exact name match to existing RansomwareGroup/RansomGroup 'chaos'
- Target
- unknown
- Resolution method
- automatic
- Provenance
- news-scan
- Rule version
- 2026-09-12.1
- Resolution rule
- R2_name_matches_known_actor
- Resolved at
- 2026-09-12T04:34:24+00:00
- Scan confidence
- 0.8
- Suspected origin
- unknown
Explore this actor's full graph with Ninja Signal