CHAOS Ransomware Gang: 4 New US Victims Posted — Manufacturing & Healthcare Targeting Analysis With Detection Rules

---
title: CHAOS Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 8f3a1c2e-4b7d-4e9a-b1c5-9d2e6f8a3b01
status: production
description: Detects deletion or resizing of Volume Shadow Copies via vssadmin, wmic, or bcdedit — a near-universal pre-encryption step in CHAOS affiliate playbooks.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/09/15
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.impact
  - attack.t1490
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'recoveryenabled no'
      - 'delete shadows all'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows (rare on endpoints; alert anyway)
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
---
title: CHAOS Ransomware - RMM and Lateral Movement Tool Execution From Unusual Parent
id: 2c7d9e4a-6f1b-4a8c-c3d7-1e5a9b2d4f06
status: production
description: Detects PsExec-style service execution, WMI remote process spawn, and ScreenConnect/RMM binaries launched from suspicious parents — consistent with CHAOS affiliate lateral movement after edge-device or RMM exploitation.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/09/15
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1219
detection:
  selection_tools:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\screenconnect.clientservice.exe'
      - '\rclone.exe'
  selection_parent:
    ParentImage|endswith:
      - '\wmiprvse.exe'
      - '\services.exe'
      - '\winlogon.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\powershell.exe'
  condition: selection_tools and selection_parent
falsepositives:
  - Managed IT tooling used by legitimate administrators — baseline known admin workstations and service accounts
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
  - Computer
---
title: CHAOS Ransomware - Data Staging Archive Creation Before Exfiltration
id: 5e1b8d3c-9a4f-4c6e-d2b8-7f3c1a9e5d02
status: production
description: Detects mass archive creation (7z/rar/tar via CLI) targeting document and database directories — indicative of CHAOS pre-extortion data staging in the 48-72h window before encryption.
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
date: 2026/09/15
logsource:
  category: process_creation
  product: windows
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
detection:
  selection_img:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
      - '\tar.exe'
  selection_cmd:
    CommandLine|contains:
      - ' a '
      - '-mx'
      - '.7z'
      - '.rar'
      - '.zip'
  selection_dirs:
    CommandLine|contains:
      - '\\shares\\'
      - '\\users\\'
      - 'documents'
      - 'backup'
      - 'database'
  filter_system:
    User|contains: 'SYSTEM'
  condition: selection_img and selection_cmd and selection_dirs and not filter_system
falsepositives:
  - Endpoint backup agents, software packaging — tune against known backup software paths
fields:
  - Image
  - CommandLine
  - User
  - Computer

// CHAOS Campaign Hunt: lateral movement + staging chain (last 14 days)
// Correlates remote execution, shadow copy tampering, and bulk archive/exfil tooling per host
let lookback = 14d;
let LateralExec = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("psexec.exe","psexesvc.exe","paexec.exe","wmic.exe","rclone.exe","screenconnect.clientservice.exe")
   or (InitiatingProcessFileName =~ "wmiprvse.exe" and FileName !in~ ("conhost.exe","wmiprvse.exe"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
let ShadowTamper = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("vssadmin.exe","bcdedit.exe","diskshadow.exe","wmic.exe")
| where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","resize shadowstorage","recoveryenabled no")
| project ShadowTime=TimeGenerated, DeviceName, ShadowCmd=ProcessCommandLine;
let Staging = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("7z.exe","7za.exe","rar.exe","tar.exe","rclone.exe")
| where ProcessCommandLine has_any (".7z",".rar",".zip","copy ","sync ","mega","s3","b2")
| project StageTime=TimeGenerated, DeviceName, StageCmd=ProcessCommandLine;
LateralExec
| join kind=leftouter (ShadowTamper) on DeviceName
| join kind=leftouter (Staging) on DeviceName
| summarize FirstSeen=min(TimeGenerated), LateralCmds=make_set(ProcessCommandLine, 5),
    ShadowCmd=any(ShadowCmd), StageCmd=any(StageCmd)
  by DeviceName, AccountName
| extend RiskScore = (iif(isnotempty(ShadowCmd),40,0)) + (iif(isnotempty(StageCmd),35,0)) + 25
| order by RiskScore desc, FirstSeen asc;

# CHAOS Rapid Triage — run on suspect hosts or via your remote execution tooling
# Checks: new scheduled tasks, new local admins, shadow copy state, suspicious RMM binaries
$cutoff = (Get-Date).AddDays(-7)

Write-Host "=== [1] Scheduled Tasks Created/Modified in Last 7 Days ===" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($info -and $info.LastRunTime -gt $cutoff) {
        [PSCustomObject]@{ Task=$_.TaskName; Path=$_.TaskPath; LastRun=$info.LastRunTime; Action=($_.Actions.Execute -join ';') }
    }
} | Format-Table -AutoSize

Write-Host "=== [2] Local Administrators (flag unexpected additions) ===" -ForegroundColor Cyan
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | Format-Table Name, ObjectClass -AutoSize

Write-Host "=== [3] Volume Shadow Copy Inventory (should be non-empty) ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: NO shadow copies present — possible pre-encryption deletion!" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }

Write-Host "=== [4] Recent vssadmin/bcdedit/rclone/psexec artifacts in Prefetch ===" -ForegroundColor Cyan
Get-ChildItem "C:\Windows\Prefetch" -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Name -match 'VSSADMIN|BCDEDIT|RCLONE|PSEXEC|7Z|RAR' } |
  Select-Object Name, LastWriteTime | Format-Table -AutoSize

Write-Host "=== [5] Unauthorized RMM Binaries ===" -ForegroundColor Cyan
$rmm = @('screenconnect','anydesk','teamviewer','splashtop','atera','ninjaone','rclone')
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)','C:\ProgramData' -Directory -ErrorAction SilentlyContinue |
  Where-Object { $n=$_.Name.ToLower(); $rmm | Where-Object { $n -match $_ } } |
  Select-Object FullName, CreationTime | Format-Table -AutoSize

Write-Host "=== Triage complete. Escalate any hits on [3] or [5] immediately. ===" -ForegroundColor Green