{
  "slug": "chaos",
  "group": "chaos",
  "name": "Chaos",
  "note": "Not ATT&CK S0220, an unrelated Linux backdoor.",
  "attck": [],
  "activity": {
    "postings": 19,
    "first": "2026-08-25",
    "last": "2026-11-03",
    "countries": {
      "US": 12,
      "GB": 3,
      "TW": 1,
      "AU": 1,
      "NL": 1,
      "CN": 1
    },
    "sectors": {
      "manufacturing": 7,
      "consumer": 1,
      "healthcare": 5,
      "services": 2,
      "unknown": 4
    },
    "recent": [
      {
        "date": "2026-11-03",
        "name": "darrequipment.com",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/ZGFycmVxdWlwbWVudC5jb21AY2hhb3M"
      },
      {
        "date": "2026-10-23",
        "name": "mickeybody.com",
        "country": "US",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/bWlja2V5Ym9keS5jb21AY2hhb3M"
      },
      {
        "date": "2026-10-09",
        "name": "astranahealth.com",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/YXN0cmFuYWhlYWx0aC5jb21AY2hhb3M"
      },
      {
        "date": "2026-10-01",
        "name": "parkdental.com",
        "country": "GB",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/cGFya2RlbnRhbC5jb21AY2hhb3M="
      },
      {
        "date": "2026-09-29",
        "name": "advantech.com",
        "country": "TW",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/YWR2YW50ZWNoLmNvbUBjaGFvcw=="
      },
      {
        "date": "2026-09-29",
        "name": "carolinaasthma.com",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/Y2Fyb2xpbmFhc3RobWEuY29tQGNoYW9z"
      },
      {
        "date": "2026-09-17",
        "name": "expresspros.com",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/ZXhwcmVzc3Byb3MuY29tQGNoYW9z"
      },
      {
        "date": "2026-09-14",
        "name": "glasfloss.com",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/Z2xhc2Zsb3NzLmNvbUBjaGFvcw=="
      },
      {
        "date": "2026-09-14",
        "name": "steelhausinc.com",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/c3RlZWxoYXVzaW5jLmNvbUBjaGFvcw=="
      },
      {
        "date": "2026-09-10",
        "name": "mankatoclinic.com",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/bWFua2F0b2NsaW5pYy5jb21AY2hhb3M="
      },
      {
        "date": "2026-09-10",
        "name": "artiflexmfg.com",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/YXJ0aWZsZXhtZmcuY29tQGNoYW9z"
      },
      {
        "date": "2026-09-08",
        "name": "copeplastics.com",
        "country": "GB",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/Y29wZXBsYXN0aWNzLmNvbUBjaGFvcw=="
      }
    ]
  },
  "convergences": [
    {
      "name": "Park Dental Partners, Inc.",
      "flagged": "2026-10-14",
      "classes": [
        "filing",
        "leak",
        "notice"
      ],
      "curated": true,
      "hand_picked": false
    },
    {
      "name": "Opportune LLP",
      "flagged": "2026-09-19",
      "classes": [
        "leak",
        "notice"
      ],
      "curated": false,
      "hand_picked": false
    }
  ],
  "reports": [
    {
      "url": "https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/",
      "publisher": "Arctic Wolf",
      "published": "2026-10-26",
      "title": "Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access",
      "origin": "feed",
      "primary": false
    },
    {
      "url": "https://www.huntress.com/blog/fake-gta6-download-malware-analysis",
      "publisher": "Huntress",
      "published": "2026-09-09",
      "title": "Grand Theft Auto VI hype leads to malware",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [],
  "cves": [],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 0,
    "defendable": 0,
    "covered": 0,
    "uncovered": []
  }
}