The Evolution of Chaos: Ransomware’s New Era of Speed and Intelligence

In 2025, Chaos ransomware has evolved into Chaos-C++, a sophisticated variant that marks a departure from its .NET roots and introduces destructive extortion and cryptocurrency theft capabilities, described as the most dangerous iteration to date.

According to Fortinet, the strain combines multiple attack vectors in a single assault, employing a tiered encryption strategy that encrypts files under 50MB, skips medium-sized files between 50MB and 1.3GB, and deletes content from files larger than 1.3GB to prevent recovery. It primarily uses AES-256-CFB via Windows CryptoAPI, with an XOR-based fallback when cryptographic libraries are unavailable, ensuring operation across diverse systems.

The deployment includes social engineering as “System Optimizer v2.1,” persistence via mutexes and process impersonation, and stealth techniques such as svchost.exe impersonation and deliberate delays to evade sandboxes. In addition to encryption, Chaos-C++ integrates cryptocurrency theft through clipboard hijacking, replacing Bitcoin addresses with attacker-controlled wallets and dropping a ransom note in the AppData directory. This combination signals a shift toward a persistent, multi-vector threat that extends beyond initial infections and ransom payments.