[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffSHK7np2gbJW_rR0r5bQ-IOlE2ZbNApmlf2SD_dQbNE":3,"$fonp5kdCex4hK2LvLC_0GRwiCKgnfVmCl7BtI3xKVr0Y":77},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":74,"created_at":75,"updated_at":76,"published_at":35},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater disguised espionage intrusion as Chaos ransomware, Rapid7 reported in May","Rapid7 attributed the intrusion to the Iranian group with moderate confidence, citing infrastructure overlap, a code-signing identity previously used on MuddyWater malware, and tradecraft; initial access came through Microsoft Teams social engineering.","In May 2026 Rapid7 reported an intrusion that carried Chaos ransomware branding but, in its assessment, was an espionage operation by the Iranian state-linked group MuddyWater. The attackers gained access through Microsoft Teams social engineering, stole credentials, deployed a custom backdoor and exfiltrated data, and Rapid7 found no file encryption despite the Chaos artefacts.",[10,11,12,13,14],"MuddyWater","Chaos Ransomware","Rapid7","Microsoft Teams","Iran","# MuddyWater disguised espionage intrusion as Chaos ransomware, Rapid7 reported in May\n\n*Rapid7 attributed the intrusion to the Iranian group with moderate confidence, citing infrastructure overlap, a code-signing identity previously used on MuddyWater malware, and tradecraft; initial access came through Microsoft Teams social engineering.*\n\n**Tags:** `MuddyWater` `Chaos Ransomware` `Rapid7` `Microsoft Teams` `Iran`\n\n> In May 2026 Rapid7 reported an intrusion that carried Chaos ransomware branding but, in its assessment, was an espionage operation by the Iranian state-linked group MuddyWater. The attackers gained access through Microsoft Teams social engineering, stole credentials, deployed a custom backdoor and exfiltrated data, and Rapid7 found no file encryption despite the Chaos artefacts.\n\n---\n\n## Background: a ransomware brand used as cover\n\nOn 6 May 2026 Rapid7 published an analysis of an intrusion that presented as a Chaos ransomware attack, complete with an extortion email and an entry on the Chaos leak portal. Rapid7 attributed the activity, with moderate confidence, to MuddyWater, an Iranian state-linked group also tracked as Static Kitten, Mango Sandstorm and Seedworm.\n\nRapid7 assessed that the primary goal was not financial gain. It noted the apparent absence of file encryption despite the presence of Chaos ransomware artefacts, and judged that the ransomware branding was most likely a decoy to complicate incident response and attribution while the attackers focused on data exfiltration and persistent access.\n\nChaos is a ransomware-as-a-service operation that emerged in 2025, known for big-game hunting, double extortion and social engineering, mostly against US organisations, according to BleepingComputer.\n\n## How the intrusion worked\n\nThe intrusion began with social engineering over Microsoft Teams. The attackers contacted employees through external chats, started screen-sharing sessions, harvested credentials and manipulated MFA settings. Credentials were stolen through phishing pages posing as Microsoft Quick Assist or by persuading victims to type passwords into local text files. In some cases the attackers deployed AnyDesk.\n\nThey then logged in to internal systems, including a domain controller, and set up persistence using RDP, DWAgent and AnyDesk.\n\nA loader, ms_upd.exe, dropped a custom backdoor named Game.exe, disguised as a Microsoft WebView2 application. Game.exe supports 12 commands, including command execution through cmd.exe or PowerShell, file upload and deletion, and persistent shell access. It also carries anti-analysis and anti-VM checks, comparing the processor name against virtualisation keywords such as VMware, KVM and Hyper-V.\n\n## Why Rapid7 points to MuddyWater\n\nRapid7 based its attribution on infrastructure overlap, operational tradecraft and a code-signing identity. The downloader ms_upd.exe was signed with a certificate that Rapid7 says had historically been used to sign Stagecomp, which it links to the Darkcomp backdoor and to MuddyWater. Rapid7 lists the certificate as revoked shortly after deployment. It does not say that Game.exe or any Chaos component was signed with it.\n\nRapid7 also noted that in late 2025 MuddyWater was linked to activity involving the Qilin ransomware-as-a-service ecosystem in an operation against an Israeli organisation, and suggested the group may have moved to Chaos branding after that activity was publicly attributed to Iran's Ministry of Intelligence and Security.\n\n## Key points\n\n- Rapid7 reported in May 2026 that an intrusion branded as Chaos ransomware was, in its assessment, a MuddyWater espionage operation, with no file encryption observed.\n- Initial access came through Microsoft Teams social engineering, with credential theft and MFA manipulation.\n- The custom backdoor Game.exe, dropped by the ms_upd.exe loader, supports 12 commands and includes anti-VM checks.\n- Attribution, at moderate confidence, rests on infrastructure overlap, tradecraft and a code-signing identity on the loader that was previously used on Stagecomp.\n- MuddyWater was linked to Qilin ransomware activity against an Israeli organisation in late 2025.\n\n## Further reading & sources\n\n- [Muddying the tracks: the state-sponsored shadow behind Chaos ransomware | Rapid7](https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Ftr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware\u002F)\n- [MuddyWater hackers use Chaos ransomware as a decoy in attacks | BleepingComputer](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmuddywater-hackers-use-chaos-ransomware-as-a-decoy-in-attacks\u002F)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb",{"actors":18,"malware":36,"timeline":48,"techniques":57,"technologies":62},[19,25,31],{"url":20,"name":10,"slug":21,"type":22,"origin":23,"motivation":24},"\u002Fthreat-groups\u002Fmuddywater","muddywater","apt","Iran (subordinate element of the Ministry of Intelligence and Security, MOIS)","espionage",{"url":26,"name":27,"slug":27,"type":28,"origin":29,"motivation":30},"\u002Fthreat-groups\u002Fqilin","qilin","ransomware","Russia \u002F Russian-speaking (excludes CIS countries from targeting)","financial",{"url":32,"name":33,"slug":34,"type":28,"origin":35,"motivation":30},"\u002Fthreat-groups\u002Fchaos","Chaos","chaos",null,[37,39,41,43,44,46],{"name":38},"ChainShell",{"name":40},"Qilin",{"name":42},"Stagecomp",{"name":33},{"name":45},"Darkcomp",{"name":47},"DinDoor",[49,53],{"date":50,"event":51,"description":52},"2025-Q4","Attack","MuddyWater deployed Qilin ransomware against an Israeli organization",{"date":54,"event":55,"description":56},"2026-03","Active campaign","MuddyWater continued operations in March 2026",[58],{"id":59,"url":60,"name":61},"T1059.001","\u002Fmitre-attack\u002Ftechniques\u002FT1059.001","PowerShell",[63,64,67,69,72],{"vendor":10,"product":38},{"vendor":65,"product":66},"Microsoft","Quick Assist",{"vendor":65,"product":68},"Teams",{"vendor":70,"product":71},"Google","Chrome",{"vendor":65,"product":73},"WebView2","threat_actor_activity","2026-09-02T07:19:02.642087+00:00","2026-10-16T12:28:57.543195+00:00",{"articles":78},[79,92,105,118],{"slug":80,"title":81,"summary":82,"tags":83,"hero_image_url":90,"story_type":74,"created_at":91},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[84,85,86,87,88,89],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","2026-10-18T12:09:44.53734+00:00",{"slug":93,"title":94,"summary":95,"tags":96,"hero_image_url":103,"story_type":74,"created_at":104},"kaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz","Kaspersky Unveils Armored Likho APT Using BusySnake Stealer Against Russian, Brazilian, and Kazakh Government and Critical Infrastructure","Kaspersky has described a previously unknown APT group, Armored Likho, running a spear-phishing campaign that drops a previously undocumented Python infostealer called BusySnake Stealer against government agencies and the electric power sector in Russia, Brazil and Kazakhstan.",[97,98,99,100,101,102],"Armored Likho","BusySnake Stealer","Kaspersky","APT","spear-phishing","critical infrastructure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fkaspersky-unveils-armored-likho-apt-using-busysnake-stealer-against-russian-braz.png?v=1bc6e1f6d4","2026-09-19T12:06:09.947355+00:00",{"slug":106,"title":107,"summary":108,"tags":109,"hero_image_url":116,"story_type":74,"created_at":117},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.",[110,111,112,113,114,115],"Gunra","AhnLab ASEC","Operation Double Barrel","FortiOS","FortiProxy","Ransomware","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"slug":119,"title":120,"summary":121,"tags":122,"hero_image_url":129,"story_type":74,"created_at":130},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA","Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.",[123,124,125,126,127,128],"ShinyHunters","Salesforce","MFA bypass","OAuth","Cato Networks","UNC6040","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","2026-09-05T07:16:15.004025+00:00"]