HOMETHREATSChaes
APT / THREAT GROUP

Chaes

2
aliases
Last seen:Mar 17, 2026

Intelligence Profile

This malware made its first appearance during the middle to end of 2020, it specifically targets Brazil and the largest e-commerce company in Latin America, Mercado Livre. It is a multistage malware deployment which uses several legitimate Windows processes and open source tools to remain undetected.

Threat Analysis

Chaes is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.morphisec.com/chaes-chronicles
→https://blog.morphisec.com/chaes4-new-chaes-malware-variant-targeting-financial-and-logistics-customers
→https://decoded.avast.io/anhho/chasing-chaes-kill-chain/
→https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf
→https://www.morphisec.com/hubfs/Chae$_Chronicles_Chaes4.1.pdf

Quick Facts

TypeAPT / Threat Group
Aliases2

Also Known As

win.chaesChaes

External Intelligence

Malpedia: win.chaes

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Chaes
Chaes — APT / Threat Group | Threat Intelligence | CTIWATCH.COM