Threat Actor Activity2 Sept 2026·2 sources
MuddyWater disguised espionage intrusion as Chaos ransomware, Rapid7 reported in May
In May 2026 Rapid7 reported an intrusion that carried Chaos ransomware branding but, in its assessment, was an espionage operation by the Iranian state-linked group MuddyWater. The attackers gained access through Microsoft Teams social engineering, stole credentials, deployed a custom backdoor and exfiltrated data, and Rapid7 found no file encryption despite the Chaos artefacts.
MuddyWaterChaos RansomwareRapid7+2
