Chaos Emerges as Faster, Smarter, and More Dangerous Ransomware

Security teams are currently addressing a new ransomware strain characterized by its rapid encryption capabilities and advanced sophistication.

Detected in late September 2025, this ransomware encrypts critical data within seconds, significantly reducing intervention time.

Affected sectors include manufacturing, healthcare, and finance, where system-wide outages have been reported due to large-scale attacks exploiting remote desktop protocol (RDP) vulnerabilities and spear-phishing tactics.

Forensic analysis reveals that the malware uses a custom loader, exploiting unsecured RDP sessions and concealing itself within packed DLL modules, facilitating fast lateral movement across networks.

The ransomware's communication involves callbacks to command-and-control servers using bullet-proof infrastructures, with fast-flux DNS rotation complicating mitigation efforts. Encrypted communications employ ChaCha20 streams linked to unique session tokens, ensuring isolated attack instances.

Victims have reported payload sizes under 100 KB, indicating significant code optimization. Initial response teams have struggled to decrypt locked volumes before data destruction routines could execute, resulting in the deletion of backup snapshots and volume shadow copies.

Researchers from Fortinet identified the ransomware strain after observing high-severity alerts from anomalous DLL loads and unusual file renaming patterns. The malware's polymorphic engine alters code with each compilation, affecting signature-based detection by antivirus products.

Dynamic analysis shows that the encryption process involves a child process that drops a loader stub into memory, optimizing for speed over obfuscation.

Shortly after its discovery, threat intelligence confirmed new ransom notes demanding Monero payments, with amounts based on automated asset valuations.

The ransomware uses a hybrid RSA-EC encryption scheme, combining 3072-bit RSA for key exchange with elliptic-curve ChaCha20 for file encryption, resulting in rapid file locking and secure key exchange.

Infection Mechanism: In-Memory Execution and Loader Hand-Off

This ransomware employs a two-stage in-memory execution process for increased stealth and speed. The initial dropper mimics a legitimate MSI installer, utilizing Windows Management Instrumentation (WMI) to execute a secondary payload in kernel memory.

Upon execution, the loader allocates memory, writes the decryption stub, and transfers control as follows:

LPVOID exec_mem = VirtualAlloc(NULL, shellcodeSize, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); RtlCopyMemory(exec_mem, encryptedShellcode, shellcodeSize); DWORD oldProtect; VirtualProtect(exec_mem, shellcodeSize, PAGE_EXECUTE_READ, &oldProtect); ((void(*)())exec_mem)();

This method bypasses disk writes, minimizing artifacts on the host filesystem. The malware resolves API addresses at runtime, avoiding static analysis and enabling rapid encryption of files on local drives and network shares.

The in-memory execution enhances persistence, with the loader injecting a stub into the LSASS process and registering a scheduled task for system startup. Combined with registry run-keys and WMI event subscriptions, this complicates remediation efforts, often necessitating complete system rebuilds.

Based on reporting by Cyber Security News.