ransomware
Chaos
The Chaos ransomware builder lineage, here as a TorBrowserTor-named variant with its own crypter. Named by 1 report, 7 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: Chaos-TorBrowserTor, Chaos-TorBrowserTor-Crypter, Chaos ransomware builder, Chaos ransomware. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Chaos Ransomware (TorBrowserTor) Multi-Stage Loader (94.103.1.13)
MALW_ChaosLoader_Stage4_MutexGUID_CrossBuildInvariant, MALW_ChaosLoader_BatchDropper_StructuralAnchors, MALW_ChaosLoader_Stage5b_UACBypass_CrossBuildInvariant, MALW_ChaosLoader_mymain_InMemory_CrypterKeys, MALW_ChaosLoader_myfile_InMemory_CrypterKeys
Detection rules
Chaos Ransomware (TorBrowserTor) Multi-Stage Loader (94.103.1.13)
RANSOM_ChaosBuilder_TorBrowserTor_Stage5a, RANSOM_ChaosBuilder_TorBrowserTor_FilesystemArtefacts
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-005: Chaos ransomware builder user with a private five-stage crypter
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.