MuddyWater disguises espionage as Chaos ransomware
Rapid7 has attributed a campaign to the Iranian state-linked threat group MuddyWater, which masquerades as Chaos ransomware to obscure its true espionage objective. The operation blends conventional cybercriminal tactics with methods historically tied to MuddyWater, also tracked as Static Kitten, Mango Sandstorm, and Seedworm.
The primary goal is data exfiltration and persistent remote access, not encryption. Attackers used Microsoft Teams social engineering for initial access, then deployed credential theft, PowerShell and CMD command execution, file manipulation, and a persistent remote shell. The Chaos ransomware branding—complete with data exfiltration, an extortion email, and a leak portal entry—serves as a decoy to complicate incident response and attribution.
Rapid7 cites infrastructure overlap, a reused code-signing certificate previously used to sign Stagecomp and Darkcomp malware, and operational tradecraft as the basis for attribution. The group has used ransomware as cover before, deploying Qilin in a late-2025 operation against an Israeli target. The shift to Chaos likely reflects an effort to distance newer assets from the well-known MuddyWater footprint.
How the attack works
Initial access is delivered through a Microsoft Teams social engineering lure. The attacker sends a Teams message to the target, prompting the user to open a link that drops the payload. Once executed, the implant establishes a foothold and begins the post-exploitation sequence.
The payload is the Chaos ransomware binary, which Rapid7 notes supports 12 distinct commands. These cover PowerShell and CMD command execution, file upload and deletion, and a persistent remote shell. The command set gives the attacker full control over the target without needing to stage a separate tool. The binary also ships with anti-analysis and anti-VM checks enabled, so it resists common sandbox and virtual machine detection during initial execution.
Why it's MuddyWater, not Chaos
Rapid7’s attribution rests on three pillars: shared infrastructure, a reused code-signing certificate, and operational tradecraft. The certificate is the strongest link — it was previously used to sign Stagecomp and Darkcomp malware, both of which have been attributed to MuddyWater by Google, Microsoft, and Kaspersky. The same cert now signs the Chaos ransomware binary in this campaign, tying the new asset to the group’s established signing chain.
The infrastructure overlap is not a single IP or domain; it spans the C2 and download servers used in this operation against known MuddyWater assets. Rapid7 rates its confidence as moderate, which is consistent with a cert-reuse plus infra match rather than a full C2 protocol or unique string match. The group has used this pattern before, deploying Qilin ransomware in a late-2025 operation against an Israeli target, so the shift to Chaos is a deliberate move to keep the new asset away from the well-known MuddyWater footprint.
Not the first time
This is not the first time MuddyWater has leaned on ransomware to muddy the water. In late 2025, the group deployed Qilin ransomware against an Israeli organization, using the same pattern: a well-known RaaS brand to mask what was really an espionage operation. The shift to Chaos here is a deliberate move to keep the new asset away from the group’s established footprint, which has been tied to the same code-signing certificate for years.
The pattern is consistent with how state-sponsored actors have been using ransomware as cover for a while now. MuddyWater has been doing it since at least 2024, and the Qilin drop in late 2025 was the clearest public example before this one. The Chaos branding—complete with the leak portal entry and extortion email—serves as the decoy that makes incident response teams pause and ask whether this is actually a ransomware attack or something else.
Key points
- MuddyWater deployed Chaos ransomware as a decoy to obscure attribution and complicate incident response.
- Initial access was achieved via Microsoft Teams social engineering, with anti-VM checks and 12 commands including PowerShell, CMD, file upload/delete, and persistent shell.
- Attribution rests on a reused code-signing certificate previously used to sign Stagecomp and Darkcomp malware, plus infrastructure overlap.
- This follows a late-2025 operation where MuddyWater used Qilin ransomware against an Israeli target.
- Rapid7 rates attribution confidence as moderate, citing the cert, infrastructure, and tradecraft.
Further reading & sources
- Canary Trap’s Bi-Weekly Cyber Roundup - Canary Trap — Canary Trap
- JUMPSEC | Inspires school children to work in cybersecurity
- Iran’s MuddyWater Hackers Hit US Firms with New 'Dindoor' Backdoor - Infosecurity Magazine
- MuddyWater hackers use Chaos ransomware as a decoy in attacks
- Industrial Ransomware Analysis for Q2 2026
- Medium
- ChainShell: MuddyWater's Russian MaaS Link | JUMPSEC
- Iran-Affiliated Cyber-Espionage: MuddyWater Threat Report