Chaos Ransomware Evolves to C++, Uses Destructive Extortion to Delete Large Files and Hijack Bitcoin Clipboard

Chaos-C++, the latest Chaos ransomware variant identified by FortiGuard Labs and released publicly on 9 October 2025, marks the first Chaos version written outside the .NET framework and combines encryption, destructive extortion and cryptocurrency theft in a single operation.

According to FortiGuard Labs, the attack chain starts with a downloader masquerading as a fake utility called System Optimizer v2.1, which prints bogus optimisation messages while quietly deploying the ransomware payload via CreateProcessA with the CREATE_NO_WINDOW flag. The sample checks for administrative rights by attempting to create a file at C:\WINDOWS\test.tmp and then executes a series of destructive commands aimed at removing recovery options, including vssadmin delete shadows and bcdedit settings.

It targets files by size with a three-tier approach: encrypts files up to 50 MB, skips those between 50 MB and 1.3 GB to speed up intrusion, and deletes content for files larger than 1.3 GB, a pattern described by FortiGuard as a rare but highly damaging tactic. A notable feature is clipboard hijacking, where the malware replaces detected Bitcoin addresses in the clipboard with a hardcoded attacker wallet, potentially redirecting ransom payments. FortiGuard notes that these behaviors are observed across Chaos variants, underscoring a shift toward faster, more destructive extortion.