← All families

Also written as: OrcusRAT-WardowCrack, OrcusRAT. These are the spellings the rules, feeds and profiles use; the page collects all of them.

Reports

Detection rules

YARA rules whose family metadata names this family, by detection page.

Tracked actors

Designations whose profile lists this family as tooling.

• UTA-2026-005: Chaos ransomware builder user with a private five-stage crypter

A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.