[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLhCW6liQX5UzogC0M8g9H19C_PKmgis6kxsNHsoZTyU":3,"$fkWU67UNXUx3ZmThcVvsP_SjEMpIXVeGCKtm1ms-ZKDA":81},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":78,"created_at":79,"updated_at":80,"published_at":39},"muddywater-disguises-chaos-ransomware-as-decoy-in-microsoft-teams-vishing-attack","MuddyWater Disguises Chaos Ransomware as Decoy in Microsoft Teams Vishing Attacks","Rapid7 attributes a Chaos ransomware intrusion to MuddyWater based on a shared code-signing certificate and infrastructure overlap, with the ransomware used to mask the primary cyber-espionage objective.","MuddyWater used Chaos ransomware as a decoy in a Microsoft Teams vishing campaign to harvest credentials, establish persistence, and exfiltrate data before attempting extortion, per Rapid7's May 2026 analysis.",[10,11,12,13,14],"MuddyWater","Chaos Ransomware","Microsoft Teams","Vishing","Rapid7","# MuddyWater Disguises Chaos Ransomware as Decoy in Microsoft Teams Vishing Attacks\n\n*Rapid7 attributes a Chaos ransomware intrusion to MuddyWater based on a shared code-signing certificate and infrastructure overlap, with the ransomware used to mask the primary cyber-espionage objective.*\n\n**Tags:** `MuddyWater` `Chaos Ransomware` `Microsoft Teams` `Vishing` `Rapid7`\n\n> MuddyWater used Chaos ransomware as a decoy in a Microsoft Teams vishing campaign to harvest credentials, establish persistence, and exfiltrate data before attempting extortion, per Rapid7's May 2026 analysis.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2025-68613 | 9.9 | 99.1% | ✅ listed | available | 89.82 (Critical) |\n\n## MuddyWater hides behind Chaos ransomware in Teams vishing\n\nMuddyWater, the Iranian state-sponsored APT also tracked as Static Kitten, Mango Sandstorm, and Seedworm, has been using Chaos ransomware as a decoy in its Microsoft Teams vishing campaigns. The group, linked to Iran’s Ministry of Intelligence and Security (MOIS), deploys the ransomware-as-a-service to mask what is primarily a cyber-espionage operation, with encryption serving as a decoy to complicate attribution.\n\nChaos is a RaaS offering 12 commands, including PowerShell and CMD execution, file upload and deletion, and persistent shell access. It includes anti-analysis and anti-VM checks. Rapid7 has moderate confidence in the attribution, based on infrastructure overlap and a code-signing certificate that MuddyWater has used to sign Stagecomp and Darkcomp malware. The team also cites operational tradecraft consistent with the group’s known patterns.\n\nThe primary goal was intelligence collection, not financial gain. MuddyWater harvests credentials via Teams, establishes persistence, exfiltrates data, and then drops the Chaos ransomware to force the victim to engage. The strategy aligns with the group’s history of using ransomware to mask espionage, including a late-2025 deployment of Qilin against an Israeli organization.\n\n## How the Teams vishing works\n\nThe initial access vector is Microsoft Teams social engineering, not a traditional RDP or RMM session. The attacker sends a Teams meeting invite that, when accepted, drops a credential-harvesting prompt into the victim’s browser. This is the same Teams pretext Payouts King uses to deploy Edgecution, but here it feeds directly into the MuddyWater chain.\n\nOnce the victim submits their credentials, the attacker pivots to data exfiltration and account takeover. The group pulls what it needs, then establishes persistence through legitimate remote access tooling before it attempts extortion. The sequence is deliberate: credential theft first, then exfil, then the remote access tool, and finally the extortion email and Chaos leak portal entry.\n\nThe attack is data-theft-only in style. There is no encryption pass over the victim’s files. The attacker exfiltrates the data, sends the extortion email, and posts the entry on the Chaos leak portal. The absence of an encryptor, combined with the emphasis on durable access and the technical overlap with known MuddyWater infrastructure, is what separates this from a financially motivated RaaS drop.\n\n## Why the ransomware is a decoy\n\nMuddyWater has used ransomware as a decoy before. In late 2025, the group deployed Qilin against an Israeli organization, a pattern that fits the current Chaos branding. The ransomware is not the primary objective; it is the layer that makes the intrusion look like a routine RaaS drop.\n\nChaos was chosen deliberately. The RaaS brand carries 12 commands — PowerShell and CMD execution, file upload and deletion, persistent shell access — plus anti-analysis and anti-VM checks. That is enough to make a victim believe they are dealing with a financially motivated crew, not a state actor running a long-term espionage chain.\n\nThe absence of an encryptor is the tell. MuddyWater does not run a full encryption pass over the victim’s files. It harvests credentials via Teams, exfiltrates the data, establishes durable access, and then drops the Chaos ransomware to force engagement. The emphasis on persistent access and the technical overlap with known MuddyWater infrastructure separate this from a standard RaaS drop.\n\nRapid7 puts it plainly: “The strategy highlights the convergence between state-sponsored techniques and those that weren’t.”\n\n## Attribution and confidence\n\nRapid7 rates its attribution at moderate confidence, not high. The call rests on three pillars: infrastructure overlap with known MuddyWater assets, a specific code-signing certificate the group has used to sign Stagecomp and Darkcomp malware, and a set of operational tradecraft details that line up with the group’s usual patterns.\n\nMuddyWater is the Iranian state-sponsored espionage group also tracked as Static Kitten, Mango Sandstorm, and Seedworm. It is the same actor that has run long-term network intrusion campaigns for Iran’s Ministry of Intelligence and Security (MOIS) for years, and the one that just deployed Qilin against an Israeli org in late 2025.\n\nThe Chaos ransomware doing the heavy lifting is a RaaS with 12 commands: PowerShell and CMD execution, file upload and delete, and a persistent shell. It also carries anti-analysis and anti-VM checks, which is what makes the victim think they are dealing with a financial crew rather than a state actor running a full espionage chain.\n\n## Key points\n\n- MuddyWater used Chaos ransomware as a decoy to mask a cyber-espionage operation and complicate attribution.\n- Initial access via Microsoft Teams social engineering for credential harvesting, followed by data exfiltration, account takeover, and persistence via remote access tooling.\n- Attribution based on infrastructure overlap, a specific code-signing certificate used for Stagecomp and Darkcomp malware, and operational tradecraft.\n- Rapid7 has moderate confidence in the attribution; the group is also known as Static Kitten, Mango Sandstorm, and Seedworm.\n- MuddyWater previously used Qilin ransomware in a late-2025 attack against an Israeli organization to mask its espionage operations.\n\n## Further reading & sources\n\n- [MuddyWater hackers use Chaos ransomware as a decoy in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmuddywater-hackers-use-chaos-ransomware-as-a-decoy-in-attacks\u002F)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [Bucklog’s Machine: Inside a Kubernetes Scanning Fleet – GreyNoise Labs](https:\u002F\u002Fwww.labs.greynoise.io\u002Fgrimoire\u002F2026-03-23-bucklog-k8s)\n- [MuddyWater’s DarkBit Ransomware Cracked, Allowing Free Data Recovery - Security Spotlight](https:\u002F\u002Fdailysecurityreview.com\u002Fsecurity-spotlight\u002Fmuddywaters-darkbit-ransomware-cracked-allowing-free-data-recovery)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-chaos-ransomware-as-decoy-in-microsoft-teams-vishing-attack.png?v=1010bd2eb1",{"cves":18,"actors":28,"malware":52,"timeline":60,"technologies":65},[19],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2025-68613",true,"\u002Fvulnerabilities\u002FCVE-2025-68613",9.9,0.9899,"Critical",89.82,"3.1",[29,35,40,46],{"url":30,"name":31,"slug":31,"type":32,"origin":33,"motivation":34},"\u002Fthreat-groups\u002Fqilin","qilin","ransomware","Russia \u002F Russian-speaking (excludes CIS countries from targeting)","financial",{"url":36,"name":37,"slug":38,"type":32,"origin":39,"motivation":34},"\u002Fthreat-groups\u002Fchaos","Chaos","chaos",null,{"url":41,"name":10,"slug":42,"type":43,"origin":44,"motivation":45},"\u002Fthreat-groups\u002Fmuddywater","muddywater","apt","Iran (subordinate element of the Ministry of Intelligence and Security, MOIS)","espionage",{"url":47,"name":48,"slug":49,"type":32,"origin":50,"motivation":51},"\u002Fthreat-groups\u002Fdarkbit","DarkBit","darkbit","Iran (assessed; MERCURY\u002FMuddyWater is linked by US Cyber Command to Iran's Ministry of Intelligence and Security)","ideological",[53,55,57,59],{"name":54},"Edgecution",{"name":56},"Darkcomp",{"name":58},"Stagecomp",{"name":48},[61],{"date":62,"event":63,"description":64},"2025-Q4","Attack","MuddyWater deployed Qilin ransomware against an Israeli organization",[66,69,71,74,76],{"vendor":67,"product":68},"SimpleHelp","RMM",{"vendor":70,"product":68},"AnyDesk",{"vendor":72,"product":73},"Microsoft","WebView2",{"vendor":72,"product":75},"Teams",{"vendor":72,"product":77},"Quick Assist","threat_actor_activity","2026-09-23T17:04:58.902559+00:00","2026-10-16T12:28:14.22794+00:00",{"articles":82},[83,91,104,117],{"slug":84,"title":85,"summary":86,"tags":87,"hero_image_url":89,"story_type":78,"created_at":90},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater Disguises Espionage Campaign as Chaos Ransomware","MuddyWater used Chaos ransomware branding to mask a state-sponsored espionage operation that included credential theft, data exfiltration, and a leak-site entry, with initial access delivered through Microsoft Teams social engineering.",[10,11,14,12,88],"Iran","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb","2026-09-02T07:19:02.642087+00:00",{"slug":92,"title":93,"summary":94,"tags":95,"hero_image_url":102,"story_type":78,"created_at":103},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[96,97,98,99,100,101],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":105,"title":106,"summary":107,"tags":108,"hero_image_url":115,"story_type":78,"created_at":116},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[109,110,111,112,113,114],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00",{"slug":118,"title":119,"summary":120,"tags":121,"hero_image_url":126,"story_type":78,"created_at":127},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[122,123,124,32,125],"AI malware","FunkSec","Palo Alto Unit 42","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00"]