Chaos Ransomware Recovery: What's Recoverable

The Chaos operation covered here emerged in early 2025. It is unrelated to the older "Chaos" ransomware builder that circulated from 2021; the shared name is a coincidence or a deliberate distraction. Researchers at Cisco Talos assess that it was probably formed by former members of the BlackSuit (Royal) group. Its leak site had listed 95 victims by 1 October 2026, 66 of them in the United States, mostly in manufacturing, technology and professional services (ransomware.live).

The attacks documented so far begin with social engineering. A member of staff is flooded with spam email, then receives a phone call from someone claiming to be IT support who offers to fix it and asks them to start Microsoft Quick Assist. That gives the attacker a remote session on a machine inside the network. Legitimate remote-management tools are then installed to keep access, credentials are collected and data is copied out.

Chaos is run as a service for affiliates and has encryptors for Windows, ESXi, Linux and NAS devices. To finish quickly it encrypts selected portions of each file instead of the whole file, and it encrypts network shares as well as local disks. Encrypted files get a .chaos extension.

The cryptography itself is sound, and no decryptor exists. But partial encryption has a consequence: in large files, much of the original content is still on disk. For database files, virtual disks and backup files, that can make it possible to rebuild a working copy from the untouched portions. How much is recoverable depends on the file type and on which parts were hit, so it is assessed per file and never promised in advance.

The other routes are the usual ones: backup repositories the attackers did not reach, and snapshots on the hypervisor or storage array that were not deleted.

Every one of those options depends on the affected storage being imaged before anything is rebuilt, reinstalled or "cleaned". That first step is what keeps the rest possible.