[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffSHK7np2gbJW_rR0r5bQ-IOlE2ZbNApmlf2SD_dQbNE":3,"$fonp5kdCex4hK2LvLC_0GRwiCKgnfVmCl7BtI3xKVr0Y":77},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":74,"created_at":75,"updated_at":76,"published_at":35},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater Disguises Espionage Campaign as Chaos Ransomware","Rapid7 attributes the intrusion to the Iranian APT based on a reused code-signing cert and infrastructure overlap, with initial access via Microsoft Teams social engineering.","MuddyWater used Chaos ransomware branding to mask a state-sponsored espionage operation that included credential theft, data exfiltration, and a leak-site entry, with initial access delivered through Microsoft Teams social engineering.",[10,11,12,13,14],"MuddyWater","Chaos Ransomware","Rapid7","Microsoft Teams","Iran","# MuddyWater Disguises Espionage Campaign as Chaos Ransomware\n\n*Rapid7 attributes the intrusion to the Iranian APT based on a reused code-signing cert and infrastructure overlap, with initial access via Microsoft Teams social engineering.*\n\n**Tags:** `MuddyWater` `Chaos Ransomware` `Rapid7` `Microsoft Teams` `Iran`\n\n> MuddyWater used Chaos ransomware branding to mask a state-sponsored espionage operation that included credential theft, data exfiltration, and a leak-site entry, with initial access delivered through Microsoft Teams social engineering.\n\n---\n\n## MuddyWater disguises espionage as Chaos ransomware\n\nRapid7 has attributed a campaign to the Iranian state-linked threat group MuddyWater, which masquerades as Chaos ransomware to obscure its true espionage objective. The operation blends conventional cybercriminal tactics with methods historically tied to MuddyWater, also tracked as Static Kitten, Mango Sandstorm, and Seedworm.\n\nThe primary goal is data exfiltration and persistent remote access, not encryption. Attackers used Microsoft Teams social engineering for initial access, then deployed credential theft, PowerShell and CMD command execution, file manipulation, and a persistent remote shell. The Chaos ransomware branding—complete with data exfiltration, an extortion email, and a leak portal entry—serves as a decoy to complicate incident response and attribution.\n\nRapid7 cites infrastructure overlap, a reused code-signing certificate previously used to sign Stagecomp and Darkcomp malware, and operational tradecraft as the basis for attribution. The group has used ransomware as cover before, deploying Qilin in a late-2025 operation against an Israeli target. The shift to Chaos likely reflects an effort to distance newer assets from the well-known MuddyWater footprint.\n\n## How the attack works\n\nInitial access is delivered through a Microsoft Teams social engineering lure. The attacker sends a Teams message to the target, prompting the user to open a link that drops the payload. Once executed, the implant establishes a foothold and begins the post-exploitation sequence.\n\nThe payload is the Chaos ransomware binary, which Rapid7 notes supports 12 distinct commands. These cover PowerShell and CMD command execution, file upload and deletion, and a persistent remote shell. The command set gives the attacker full control over the target without needing to stage a separate tool. The binary also ships with anti-analysis and anti-VM checks enabled, so it resists common sandbox and virtual machine detection during initial execution.\n\n## Why it's MuddyWater, not Chaos\n\nRapid7’s attribution rests on three pillars: shared infrastructure, a reused code-signing certificate, and operational tradecraft. The certificate is the strongest link — it was previously used to sign Stagecomp and Darkcomp malware, both of which have been attributed to MuddyWater by Google, Microsoft, and Kaspersky. The same cert now signs the Chaos ransomware binary in this campaign, tying the new asset to the group’s established signing chain.\n\nThe infrastructure overlap is not a single IP or domain; it spans the C2 and download servers used in this operation against known MuddyWater assets. Rapid7 rates its confidence as moderate, which is consistent with a cert-reuse plus infra match rather than a full C2 protocol or unique string match. The group has used this pattern before, deploying Qilin ransomware in a late-2025 operation against an Israeli target, so the shift to Chaos is a deliberate move to keep the new asset away from the well-known MuddyWater footprint.\n\n## Not the first time\n\nThis is not the first time MuddyWater has leaned on ransomware to muddy the water. In late 2025, the group deployed Qilin ransomware against an Israeli organization, using the same pattern: a well-known RaaS brand to mask what was really an espionage operation. The shift to Chaos here is a deliberate move to keep the new asset away from the group’s established footprint, which has been tied to the same code-signing certificate for years.\n\nThe pattern is consistent with how state-sponsored actors have been using ransomware as cover for a while now. MuddyWater has been doing it since at least 2024, and the Qilin drop in late 2025 was the clearest public example before this one. The Chaos branding—complete with the leak portal entry and extortion email—serves as the decoy that makes incident response teams pause and ask whether this is actually a ransomware attack or something else.\n\n## Key points\n\n- MuddyWater deployed Chaos ransomware as a decoy to obscure attribution and complicate incident response.\n- Initial access was achieved via Microsoft Teams social engineering, with anti-VM checks and 12 commands including PowerShell, CMD, file upload\u002Fdelete, and persistent shell.\n- Attribution rests on a reused code-signing certificate previously used to sign Stagecomp and Darkcomp malware, plus infrastructure overlap.\n- This follows a late-2025 operation where MuddyWater used Qilin ransomware against an Israeli target.\n- Rapid7 rates attribution confidence as moderate, citing the cert, infrastructure, and tradecraft.\n\n## Further reading & sources\n\n- [Canary Trap’s Bi-Weekly Cyber Roundup - Canary Trap](https:\u002F\u002Fcanarytrap.com\u002Fcyber-roundup-may-13) — Canary Trap\n- [JUMPSEC | Inspires school children to work in cybersecurity](https:\u002F\u002Fwww.jumpsec.com\u002Fguides\u002Fjumpsec-uncovers-iranian-state-actor-leveraging-russian-cybercrime-infrastructure-in-new-chainshell-campaign)\n- [Iran’s MuddyWater Hackers Hit US Firms with New 'Dindoor' Backdoor - Infosecurity Magazine](https:\u002F\u002Fwww.infosecurity-magazine.com\u002Fnews\u002Firan-muddywater-hackers-us-firms\u002F)\n- [MuddyWater hackers use Chaos ransomware as a decoy in attacks](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmuddywater-hackers-use-chaos-ransomware-as-a-decoy-in-attacks\u002F)\n- [Industrial Ransomware Analysis for Q2 2026](https:\u002F\u002Fwww.dragos.com\u002Fblog\u002Fdragos-industrial-ransomware-analysis-q2-2026)\n- [Medium](https:\u002F\u002Fmedium.com\u002F@rst_cloud\u002Frst-ti-report-digest-03-aug-2026-66acd26c562a)\n- [ChainShell: MuddyWater's Russian MaaS Link | JUMPSEC](https:\u002F\u002Fwww.jumpsec.com\u002Fguides\u002Fchainshell-muddywater-russian-criminal-infrastructure)\n- [Iran-Affiliated Cyber-Espionage: MuddyWater Threat Report](https:\u002F\u002Fwww.watchguard.com\u002Fwgrd-security-hub\u002Fsecplicity-blog\u002Firan-affiliated-cyber-espionage-against-global-high-value)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb",{"actors":18,"malware":36,"timeline":48,"techniques":57,"technologies":62},[19,25,31],{"url":20,"name":10,"slug":21,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fmuddywater","muddywater","apt","Iran (subordinate element of the Ministry of Intelligence and Security, MOIS)","espionage",{"url":26,"name":27,"slug":27,"type":28,"origin":29,"motivation":30},"\u002Fthreat-groups\u002Fqilin","qilin","ransomware","Russia \u002F Russian-speaking (excludes CIS countries from targeting)","financial",{"url":32,"name":33,"slug":34,"type":28,"origin":35,"motivation":30},"\u002Fthreat-groups\u002Fchaos","Chaos","chaos",null,[37,39,41,43,44,46],{"name":38},"ChainShell",{"name":40},"Qilin",{"name":42},"Stagecomp",{"name":33},{"name":45},"Darkcomp",{"name":47},"DinDoor",[49,53],{"date":50,"event":51,"description":52},"2025-Q4","Attack","MuddyWater deployed Qilin ransomware against an Israeli organization",{"date":54,"event":55,"description":56},"2026-03","Active campaign","MuddyWater continued operations in March 2026",[58],{"id":59,"url":60,"name":61},"T1059.001","\u002Fmitre-attack\u002Ftechniques\u002FT1059.001","PowerShell",[63,64,67,69,72],{"vendor":10,"product":38},{"vendor":65,"product":66},"Microsoft","Quick Assist",{"vendor":65,"product":68},"Teams",{"vendor":70,"product":71},"Google","Chrome",{"vendor":65,"product":73},"WebView2","threat_actor_activity","2026-09-02T07:19:02.642087+00:00","2026-10-16T12:28:57.543195+00:00",{"articles":78},[79,87,102,115],{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":85,"story_type":74,"created_at":86},"muddywater-disguises-chaos-ransomware-as-decoy-in-microsoft-teams-vishing-attack","MuddyWater Disguises Chaos Ransomware as Decoy in Microsoft Teams Vishing Attacks","MuddyWater used Chaos ransomware as a decoy in a Microsoft Teams vishing campaign to harvest credentials, establish persistence, and exfiltrate data before attempting extortion, per Rapid7's May 2026 analysis.",[10,11,13,84,12],"Vishing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-chaos-ransomware-as-decoy-in-microsoft-teams-vishing-attack.png?v=1010bd2eb1","2026-09-23T17:04:58.902559+00:00",{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":100,"story_type":74,"created_at":101},"fortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir","FortiGuard Labs Flags Handala Exploiting Six Vendor Vulnerabilities in Active Iran Campaign","FortiGuard Labs issued an Outbreak Alert for the Handala group, an Iran-linked actor, actively exploiting critical vulnerabilities across six major vendor products in a sustained campaign.",[92,93,14,94,65,95,96,97,98,99],"Handala","FortiGuard","Outbreak Alert","Oracle","Apache","Hikvision","Atlassian","Ivanti","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-handala-exploiting-six-vendor-vulnerabilities-in-active-ir.png?v=6da17f1ec2","2026-08-31T12:10:30.775227+00:00",{"slug":103,"title":104,"summary":105,"tags":106,"hero_image_url":113,"story_type":74,"created_at":114},"fortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-","FortiGuard Labs flags UNC1549 for spear-phishing and VDI abuse against European aerospace and telecom targets","FortiGuard Labs published an Outbreak Alert for UNC1549, a suspected Iran-linked espionage group targeting aerospace, defense, and telecom organizations in Europe with spear-phishing, credential theft, and VDI abuse for initial access and lateral movement.",[107,108,14,109,110,111,112],"UNC1549","FortiGuard Labs","spear-phishing","VDI","CVE-2021-26855","CVE-2020-0688","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffortiguard-labs-flags-unc1549-for-spear-phishing-and-vdi-abuse-against-european-.png?v=31f9fd4fc4","2026-08-31T07:09:49.726163+00:00",{"slug":116,"title":117,"summary":118,"tags":119,"hero_image_url":125,"story_type":74,"created_at":126},"sentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence","SentinelOne Refines APT42 Iran War Assessment with Three Months of New Evidence","SentinelOne's midyear assessment of the Iran War cyber threat landscape refines their April initial assessment with three months of evidence on APT42\u002FMOIS, IRGC, and persona activity, including AI-assisted spear phishing and TAMECAT backdoor deployment.",[120,14,121,122,123,124],"APT42","MOIS","IRGC","TAMECAT","Spear Phishing","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsentinelone-refines-apt42-iran-war-assessment-with-three-months-of-new-evidence.png?v=3a584a829a","2026-08-29T12:17:25.675495+00:00"]