// THREAT ACTOR
CHAOS_
ActiveCHAOS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CHAOS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
79
Victims tracked
5 / 12
Active mirrors
2025-03-31
First listing
2026-08-05
Most recent
Victims by year
- 2026 48
- 2025 31
Leak site mirrors
12 mirrors tracked, 5 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onionCHAOS snapshot · 2026-08-06 21:37 -
httj32vkww42kq3kjbsbuuv2izalkvswuyf5hepdodakrjq42ploe6ad.onionIndex of / snapshot · 2025-07-02 04:14 -
2yxf2ald2c67twt4663piypum2fu6yt4su453naxsdiilpd4m7pgu6qd.onionIndex of / snapshot · 2025-07-02 04:14 -
k6wtpxwq72gpeil5hqofae7yhbtxphbkyoe2g7rwmpx5sadc4sgsfvid.onionIndex of / snapshot · 2025-06-09 16:02 -
qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onionIndex of /goosehead/ snapshot · 2026-08-06 21:32 -
cdgi6zjox6zr5epk7k5rg673qduxy7dlkk7ws3n4vusspr5bmhx24aqd.onionCHAOS snapshot · 2026-06-16 08:11 -
bna6mhximutqknymisjbp277swmhf7gocambh6y62qmdtup34unjs7yd.onionIndex of / snapshot · 2025-07-02 04:01 -
een55qvybeygshxbblvfevk6uzcs6lhpj6num7ymbpw7z6cehozszlad.onionIndex of / snapshot · 2025-07-02 05:02 -
s2godak5cr4bflmcmiqjgow2b7clgs7szgf4h3ofqn7lyh6mdpvei5yd.onionsnapshot · 2025-09-30 22:33 -
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd.onionsnapshot · 2026-08-06 21:32 -
qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion403 Forbidden snapshot · 2026-08-06 21:31 -
myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion403 Forbidden snapshot · 2026-08-06 21:22
Recent victims
The 50 most recent victims claimed by CHAOS. Total in the index: 79.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-05 | tomorrowsoffice.com | URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office … |
| 2026-08-05 | healthcarehighways.com | WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcar… |
| 2026-07-28 | thecranewaregroup.com | Craneware’s Public Deception: The Reality Behind the 'Non-Sensitive' D… |
| 2026-07-27 | vit-best.com | DATA BREACH NOTICE: VIT-BEST.COM Status: The first 3% of the tota… |
| 2026-07-26 | remco.ca | Founded in 1977 and headquartered in Quebec, Canada, Remco is an indus… |
| 2026-07-22 | neopharmlabs.com | Notice of Data Escalation: 3% Proof Publication Management is ignorin… |
| 2026-07-22 | issvc.com | issvc.com Official Notice to Management and Stakeholders The time wi… |
| 2026-07-22 | argonautms.com | Target Organization: argonautms.com (Argonaut Manufacturing Services) … |
| 2026-07-20 | wikoff.com | [PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Dat… |
| 2026-07-16 | radiax.com | NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that w… |
| 2026-07-14 | sleemanbreweries.ca | Sleeman Breweries was founded in 1851 and headquartered in Guelph, Ont… |
| 2026-07-14 | spectrumchemical.com | Public Notice: Final Ultimatum to Spectrum Chemical Management To the… |
| 2026-07-14 | aphenapharma.com | Aphena Pharma Solutions We have gained full access to your corporate … |
| 2026-07-08 | corepharma.com | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are o… |
| 2026-07-08 | opportune.com | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are o… |
| 2026-07-06 | gisy.com | Target: Gisy.com Status: Data Exfiltration Confirmed Volume: 1.1 TB (3… |
| 2026-07-06 | aircreebec.ca | Air Creebec, founded in 1982, is a regional airline company based Wask… |
| 2026-06-30 | universalplant.com | FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of … |
| 2026-06-26 | ingerman.com | Ingerman is a developer, builder and manager of multifamily housing co… |
| 2026-06-25 | roofdepot.com | Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a r… |
| 2026-06-23 | randa.net | Randa Apparel & Accessories is a global powerhouse and one of the worl… |
| 2026-06-22 | graymont.com | NOTICE: Graymont – Final Warning We have successfully gained full acc… |
| 2026-06-09 | airespring.com | Founded in 2001, AireSpring is a Managed Services Provider specializin… |
| 2026-05-28 | entransinternational.com | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Entrans… |
| 2026-05-28 | powerhousenow.com | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Powerho… |
| 2026-05-27 | sterlingindustries.com | STERLING INDUSTRIES: FINAL NOTICE BEFORE FULL RELEASE STATUS: PENDING… |
| 2026-05-17 | wtitransport.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-17 | cstindustries.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-17 | fallprotect.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-17 | challenge-mfg.com | Company management has exactly 72 hours to contact us. Otherwise, the … |
| 2026-05-04 | vacaero.com | If the company's management does not reach an agreement with us within… |
| 2026-05-04 | www.cswindustrials.com | If the company's management does not contact us within 24 hours, we wi… |
| 2026-04-28 | cadencepetroleum.com | Company management has 48 hours to reach an agreement with us. If no a… |
| 2026-04-22 | alexandergroup.com | The company is disregarding its customers' data. If a deal is not reac… |
| 2026-04-20 | polycorp.com | If the company does not contact us within 48 hours, the files will be … |
| 2026-04-14 | coastappliances.com | It offers refrigerators, freezers, wall ovens, washers, and electric r… |
| 2026-04-14 | itc-group.com | Founded in 1983, ITC Construction Group is a Commercial and Residentia… |
| 2026-03-24 | kdmpop.com | FINAL WARNING: KDM P.O.P. SOLUTIONS STATUS: PRE-RELEASE (48 HOURS REM… |
| 2026-03-20 | smythco.com | Smyth Companies, LLC has failed to protect its infrastructure. We have… |
| 2026-03-18 | loopcap.com | We provided the management of Loop Capital with ample time and opportu… |
| 2026-03-12 | flad.com | We are announcing a major security breach and data exfiltration from F… |
| 2026-03-07 | crescentenergyco.com | Crescent is a growth-oriented U.S. independent energy company engaged … |
| 2026-03-06 | nelsonworldwide.com | NELSON Worldwide is an award-winning firm delivering architecture, int… |
| 2026-02-26 | ntic.com | Northern Technologies International Corporation (NTIC) is a specialty … |
| 2026-02-26 | milespartnership.com | The company was founded in 2005 and is based in Sarasota, Florida. Mil… |
| 2026-02-09 | horizonmedia.com | Official Announcement: Horizon Media Data Breach ULTIMATUM: Horizon M… |
| 2026-01-29 | anomatic.com | Founded in 1965 and headquartered in New Albany, Ohio, Anomatic is a f… |
| 2026-01-05 | CEIVA Logic | CEIVA is the inventor of the world's first connected digital photo fra… |
| 2025-12-26 | VEPLASTIC | Veplastic makes high-quality plastic compounds for manufacturers acros… |
| 2025-12-24 | amsino.com | Amsinos superior quality and technological advancements have gained th… |