Researchers detailed a newer double-extortion ransomware group made up of former members of BlackSuit, which was recently disrupted by international law enforcement.
July 28, 2025 By Alexander Culafi
A new ransomware gang is wreaking havoc while another gets taken down.
Cisco Talos researchers on July 24 detailed Chaos, a newer ransomware-as-a-service group that specializes in big-game hunting and double extortion attacks (meaning it both encrypts victim files and steals data for potential leaking). According to Cisco Talos, the group emerged in early February and appears to be made up of former BlackSuit ransomware gang members "based on similarities in the ransomware's encryption methodology, ransom note structure, and the toolset used in the attacks."
If that is true, the group's pedigree goes back a few years further, as BlackSuit is a fairly prolific gang that popped up in 2023. It spun off of Royal ransomware, which itself was suspected to have been made up of former Conti members.
