# Airespring compromised by Chaos ransomware gang

Published: 2026-06-09 · Severity: elevated
Canonical: https://vorant.io/reports/11942570-3d6b-5a37-80e4-4c100f4475c4/airespring-compromised-by-chaos-ransomware-gang

> Chaos ransomware operators claim compromise of Airespring with 89 users and employee credentials exposed.

Ransomware.live reports that Chaos ransomware operators have posted Airespring (airespring.com) as a victim on their leak site. The posting indicates compromise affecting 89 user accounts, 2 directly compromised employees, 5 third-party employee credentials, and 20 external attack surface exposures. The claim includes DNS records for the victim domain and a leak screenshot posted by the operators. This represents a post-compromise disclosure by the ransomware gang, indicating data exfiltration and likely encryption of systems. The breach underscores the attack chain from infostealer infections leading to credential compromise and subsequent ransomware deployment—a common pattern in which stolen credentials from malware-infected endpoints enable lateral movement and ransomware execution.

## Mentioned in this report

- Threat actors: chaos
- Malware: Chaos

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/YWlyZXNwcmluZy5jb21AY2hhb3M=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/11942570-3d6b-5a37-80e4-4c100f4475c4/airespring-compromised-by-chaos-ransomware-gang.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup