Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2025-68613 | 9.9 | 99.1% | ✅ listed | available | 89.82 (Critical) |
MuddyWater hides behind Chaos ransomware in Teams vishing
MuddyWater, the Iranian state-sponsored APT also tracked as Static Kitten, Mango Sandstorm, and Seedworm, has been using Chaos ransomware as a decoy in its Microsoft Teams vishing campaigns. The group, linked to Iran’s Ministry of Intelligence and Security (MOIS), deploys the ransomware-as-a-service to mask what is primarily a cyber-espionage operation, with encryption serving as a decoy to complicate attribution.
Chaos is a RaaS offering 12 commands, including PowerShell and CMD execution, file upload and deletion, and persistent shell access. It includes anti-analysis and anti-VM checks. Rapid7 has moderate confidence in the attribution, based on infrastructure overlap and a code-signing certificate that MuddyWater has used to sign Stagecomp and Darkcomp malware. The team also cites operational tradecraft consistent with the group’s known patterns.
The primary goal was intelligence collection, not financial gain. MuddyWater harvests credentials via Teams, establishes persistence, exfiltrates data, and then drops the Chaos ransomware to force the victim to engage. The strategy aligns with the group’s history of using ransomware to mask espionage, including a late-2025 deployment of Qilin against an Israeli organization.
How the Teams vishing works
The initial access vector is Microsoft Teams social engineering, not a traditional RDP or RMM session. The attacker sends a Teams meeting invite that, when accepted, drops a credential-harvesting prompt into the victim’s browser. This is the same Teams pretext Payouts King uses to deploy Edgecution, but here it feeds directly into the MuddyWater chain.
Once the victim submits their credentials, the attacker pivots to data exfiltration and account takeover. The group pulls what it needs, then establishes persistence through legitimate remote access tooling before it attempts extortion. The sequence is deliberate: credential theft first, then exfil, then the remote access tool, and finally the extortion email and Chaos leak portal entry.
The attack is data-theft-only in style. There is no encryption pass over the victim’s files. The attacker exfiltrates the data, sends the extortion email, and posts the entry on the Chaos leak portal. The absence of an encryptor, combined with the emphasis on durable access and the technical overlap with known MuddyWater infrastructure, is what separates this from a financially motivated RaaS drop.
Why the ransomware is a decoy
MuddyWater has used ransomware as a decoy before. In late 2025, the group deployed Qilin against an Israeli organization, a pattern that fits the current Chaos branding. The ransomware is not the primary objective; it is the layer that makes the intrusion look like a routine RaaS drop.
Chaos was chosen deliberately. The RaaS brand carries 12 commands — PowerShell and CMD execution, file upload and deletion, persistent shell access — plus anti-analysis and anti-VM checks. That is enough to make a victim believe they are dealing with a financially motivated crew, not a state actor running a long-term espionage chain.
The absence of an encryptor is the tell. MuddyWater does not run a full encryption pass over the victim’s files. It harvests credentials via Teams, exfiltrates the data, establishes durable access, and then drops the Chaos ransomware to force engagement. The emphasis on persistent access and the technical overlap with known MuddyWater infrastructure separate this from a standard RaaS drop.
Rapid7 puts it plainly: “The strategy highlights the convergence between state-sponsored techniques and those that weren’t.”
Attribution and confidence
Rapid7 rates its attribution at moderate confidence, not high. The call rests on three pillars: infrastructure overlap with known MuddyWater assets, a specific code-signing certificate the group has used to sign Stagecomp and Darkcomp malware, and a set of operational tradecraft details that line up with the group’s usual patterns.
MuddyWater is the Iranian state-sponsored espionage group also tracked as Static Kitten, Mango Sandstorm, and Seedworm. It is the same actor that has run long-term network intrusion campaigns for Iran’s Ministry of Intelligence and Security (MOIS) for years, and the one that just deployed Qilin against an Israeli org in late 2025.
The Chaos ransomware doing the heavy lifting is a RaaS with 12 commands: PowerShell and CMD execution, file upload and delete, and a persistent shell. It also carries anti-analysis and anti-VM checks, which is what makes the victim think they are dealing with a financial crew rather than a state actor running a full espionage chain.
Key points
- MuddyWater used Chaos ransomware as a decoy to mask a cyber-espionage operation and complicate attribution.
- Initial access via Microsoft Teams social engineering for credential harvesting, followed by data exfiltration, account takeover, and persistence via remote access tooling.
- Attribution based on infrastructure overlap, a specific code-signing certificate used for Stagecomp and Darkcomp malware, and operational tradecraft.
- Rapid7 has moderate confidence in the attribution; the group is also known as Static Kitten, Mango Sandstorm, and Seedworm.
- MuddyWater previously used Qilin ransomware in a late-2025 attack against an Israeli organization to mask its espionage operations.