CHAOS Ransomware Gang: 3 New Victims Posted in 24 Hours — Cross-Continental Targeting Analysis & Detection Engineering

---
title: CHAOS Ransomware - PsExec-Style Remote Service Creation (Lateral Movement)
id: 8f3a2c11-chaos-2026-0001
status: production
description: Detects remote service creation events consistent with PsExec and clone tooling (PAExec, RemCom) used by CHAOS affiliates for lateral movement prior to ransomware detonation.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_service_names:
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'RemComSvc'
  selection_suspicious_paths:
    ImagePath|contains:
      - '\ADMIN$\'
      - '\IPC$\'
      - '\\Windows\Temp\'
      - '\\Users\Public\'
  condition: selection_event and (selection_service_names or selection_suspicious_paths)
falsepositives:
  - Legitimate administrative PsExec usage by IT staff
level: high
tags:
  - attack.lateral_movement
  - attack.t1569.002
---
title: CHAOS Ransomware - Volume Shadow Copy Deletion (Pre-Encryption Impact Staging)
id: 8f3a2c11-chaos-2026-0002
status: production
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, or bcdedit — a near-universal pre-encryption action in CHAOS intrusions.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'Delete Shadows'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\WMIC.exe'
    CommandLine|contains:
      - 'shadowcopy'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled'
      - 'bootstatuspolicy'
  selection_powershell:
    CommandLine|contains:
      - 'Get-WmiObject Win32_Shadowcopy'
      - 'Remove-WmiObject'
      - 'vssadmin delete'
  condition: 1 of selection_*
falsepositives:
  - Backup software maintenance windows
level: critical
tags:
  - attack.impact
  - attack.t1490
---
title: CHAOS Ransomware - Data Staging and Exfiltration via Rclone or Archive Utilities
date: 2026/08/26
id: 8f3a2c11-chaos-2026-0003
status: production
description: Detects archive-based staging (7-Zip/WinRAR on sensitive directories) and Rclone execution consistent with CHAOS pre-leak exfiltration workflows.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_rclone:
    - Image|endswith: '\rclone.exe'
    - OriginalFileName: 'rclone.exe'
  selection_archive_tools:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_archive_cmds:
    CommandLine|contains:
      - ' a -t'
      - ' -p'
      - '\\Finance\\'
      - '\\HR\\'
      - '\\Shared\\'
      - '\\Users\\'
  selection_rclone_cmds:
    CommandLine|contains:
      - 'copy '
      - 'sync '
      - 'mega'
      - 'dropbox'
      - '--transfers'
  condition: (selection_rclone and selection_rclone_cmds) or (selection_archive_tools and selection_archive_cmds)
falsepositives:
  - Legitimate backup jobs using 7-Zip; IT cloud sync tooling
level: high
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
  - attack.t1567.002

// CHAOS Ransomware Hunt — Pre-Detonation Staging & Lateral Movement
// Microsoft Sentinel / Defender XDR
// Looks for: suspicious remote service installs, shadow copy tampering,
// archive staging on sensitive shares, and Rclone-style exfil — within 7 days.

let Lookback = 7d;
let SuspiciousSharePaths = dynamic(["\\Finance\\", "\\HR\\", "\\Shared\\", "\\Users\\Public\\", "\\Windows\\Temp\\"]);

// 1) Remote service creation consistent with PsExec/PAExec/RemCom
let RemoteSvc =
    Event
    | where TimeGenerated > ago(Lookback)
    | where EventLog == "System" and EventID == 7045
    | extend ServiceName = tostring(parse_xml(EventData).DataItem.EventData.Data.[0].["#text"]),
             ImagePath   = tostring(parse_xml(EventData).DataItem.EventData.Data.[1].["#text"])
    | where ServiceName has_any ("PSEXESVC","PAExec","RemCom")
         or ImagePath has_any ("ADMIN$","\\Windows\\Temp\\","\\Users\\Public\\")
    | project TimeGenerated, Computer, ServiceName, ImagePath;

// 2) Shadow copy / boot recovery tampering
let ShadowTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
         or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy")
         or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled","bootstatuspolicy"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName;

// 3) Archive staging + Rclone exfil on sensitive paths
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe","rclone.exe")
    | where ProcessCommandLine has_any (SuspiciousSharePaths)
         or ProcessCommandLine has_any ("--transfers","mega","dropbox"," sync "," copy ")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName;

// Correlate: devices showing 2+ behaviors are your highest-priority hosts
union RemoteSvc, ShadowTamper, Staging
| summarize BehaviorCount = dcount(TimeGenerated),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            Indicators = make_set(ProcessCommandLine, 20)
    by Device = coalesce(DeviceName, Computer)
| where BehaviorCount >= 1
| order by LastSeen desc;

# CHAOS Rapid-Response Triage — run on suspected hosts or domain-wide via GPO/SCCM
# Checks: exposed RDP config, scheduled tasks added in last 7 days, shadow copy state,
# suspicious services, and RMM tool presence.

$report = @()
$cutoff = (Get-Date).AddDays(-7)

# --- 1) RDP exposure check ---
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nlaEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication -eq 1
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$report += [pscustomobject]@{Check='RDP_Enabled'; Finding=$rdpEnabled; Risk= if($rdpEnabled -and -not $nlaEnabled){'CRITICAL - RDP on without NLA'}elseif($rdpEnabled){'Medium'}else{'Low'} }
$report += [pscustomobject]@{Check='RDP_Port'; Finding=$rdpPort; Risk= if($rdpPort -eq 3389){'Medium - default port'}else{'Low'} }

# --- 2) Scheduled tasks created in last 7 days (persistence) ---
$tasks = Get-ScheduledTask | Where-Object { $_.Date -and ([datetime]$_.Date) -gt $cutoff } |
         Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}}
foreach ($t in $tasks) { $report += [pscustomobject]@{Check='New_ScheduledTask'; Finding="$($t.TaskName) -> $($t.Action)"; Risk='High - review'} }

# --- 3) Volume Shadow Copy status (CHAOS deletes these pre-encryption) ---
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += [pscustomobject]@{Check='ShadowCopies_Present'; Finding=($shadows.Count -gt 0); Risk= if($shadows.Count -eq 0){'CRITICAL - no shadow copies (tampering or never enabled)'}else{'Low'} }

# --- 4) Suspicious services (PsExec clones, random 8-char names) ---
$svcs = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match '^(PSEXESVC|PAExec|RemCom)' -or
    $_.PathName -match '\\(Temp|Public)\\' -or
    ($_.Name -match '^[A-Za-z0-9]{8}$' -and $_.PathName -match 'Users')
} | Select-Object Name, PathName, State
foreach ($s in $svcs) { $report += [pscustomobject]@{Check='Suspicious_Service'; Finding="$($s.Name) [$($s.State)] -> $($s.PathName)"; Risk='High'} }

# --- 5) RMM tooling presence (ScreenConnect/AnyDesk abused by CHAOS) ---
$rmm = Get-CimInstance Win32_Service | Where-Object { $_.Name -match '(ScreenConnect|AnyDesk|Atera|Splashtop|TeamViewer)' }
foreach ($r in $rmm) { $report += [pscustomobject]@{Check='RMM_Tool_Present'; Finding="$($r.Name) [$($r.State)]"; Risk='Review - approved inventory?'} }

# --- Output ---
$report | Sort-Object Risk | Format-Table -AutoSize
$report | Export-Csv "chaos_triage_$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "`nTriage complete. Export written to working directory." -ForegroundColor Cyan