Note: This page is dedicated to the Yashma (Chaos v6.0) ransomware builder and does not reflect any encryptors created from the builder.
Note: This is the second iteration of the Chaos ransomware builder series. For preliminary information, see the Chaos v1.0, Chaos v2.0, Chaos v3.0, Chaos v4.0, and Chaos v5.0 entries.
Note: Two decryptors exist for Yashma, including the original decryptor from Truesec. See below.
The Yashma builder is a fork of the Chaos v5.0 builder with very minor differences. They are:
- The encryptors now have a geographic check for CIS countries.
- The ability to stop background services.
It is believed that Yashma is a fork of Chaos v5.0 created by Iranian-based threat actors who are different from the original creators of the Chaos ransomware builders. However, based on Rakesh Krishnan's research, these two entities are also believed to have some relationship.
