Background: a ransomware brand used as cover
On 6 May 2026 Rapid7 published an analysis of an intrusion that presented as a Chaos ransomware attack, complete with an extortion email and an entry on the Chaos leak portal. Rapid7 attributed the activity, with moderate confidence, to MuddyWater, an Iranian state-linked group also tracked as Static Kitten, Mango Sandstorm and Seedworm.
Rapid7 assessed that the primary goal was not financial gain. It noted the apparent absence of file encryption despite the presence of Chaos ransomware artefacts, and judged that the ransomware branding was most likely a decoy to complicate incident response and attribution while the attackers focused on data exfiltration and persistent access.
Chaos is a ransomware-as-a-service operation that emerged in 2025, known for big-game hunting, double extortion and social engineering, mostly against US organisations, according to BleepingComputer.
How the intrusion worked
The intrusion began with social engineering over Microsoft Teams. The attackers contacted employees through external chats, started screen-sharing sessions, harvested credentials and manipulated MFA settings. Credentials were stolen through phishing pages posing as Microsoft Quick Assist or by persuading victims to type passwords into local text files. In some cases the attackers deployed AnyDesk.
They then logged in to internal systems, including a domain controller, and set up persistence using RDP, DWAgent and AnyDesk.
A loader, ms_upd.exe, dropped a custom backdoor named Game.exe, disguised as a Microsoft WebView2 application. Game.exe supports 12 commands, including command execution through cmd.exe or PowerShell, file upload and deletion, and persistent shell access. It also carries anti-analysis and anti-VM checks, comparing the processor name against virtualisation keywords such as VMware, KVM and Hyper-V.
Why Rapid7 points to MuddyWater
Rapid7 based its attribution on infrastructure overlap, operational tradecraft and a code-signing identity. The downloader ms_upd.exe was signed with a certificate that Rapid7 says had historically been used to sign Stagecomp, which it links to the Darkcomp backdoor and to MuddyWater. Rapid7 lists the certificate as revoked shortly after deployment. It does not say that Game.exe or any Chaos component was signed with it.
Rapid7 also noted that in late 2025 MuddyWater was linked to activity involving the Qilin ransomware-as-a-service ecosystem in an operation against an Israeli organisation, and suggested the group may have moved to Chaos branding after that activity was publicly attributed to Iran's Ministry of Intelligence and Security.
Key points
- Rapid7 reported in May 2026 that an intrusion branded as Chaos ransomware was, in its assessment, a MuddyWater espionage operation, with no file encryption observed.
- Initial access came through Microsoft Teams social engineering, with credential theft and MFA manipulation.
- The custom backdoor Game.exe, dropped by the ms_upd.exe loader, supports 12 commands and includes anti-VM checks.
- Attribution, at moderate confidence, rests on infrastructure overlap, tradecraft and a code-signing identity on the loader that was previously used on Stagecomp.
- MuddyWater was linked to Qilin ransomware activity against an Israeli organisation in late 2025.