Rapid7 researchers have attributed a false flag ransomware operation to MuddyWater — an Iranian advanced persistent threat group operating under the Ministry of Intelligence and Security (MOIS). The campaign, active since early 2026, used Chaos ransomware as a decoy to mask the group's actual objective: credential theft and cyber-espionage via manipulated Microsoft Teams sessions.
The intrusion chain began with external Teams chat requests to employees, progressed to interactive screen-sharing sessions, and resulted in credential harvesting and MFA setting modifications. In select cases, the attackers deployed AnyDesk or DWAgent for persistent remote access, followed by a custom backdoor. Chaos ransomware was deployed last — not for financial gain, but to trigger incident response procedures that would overwrite forensic artifacts and complicate attribution.
As of late March 2026, Chaos had claimed 36 victims on its leak site, predominantly US organizations in construction, manufacturing, and business services. Any organization with external Microsoft Teams access enabled should treat this as an active threat requiring immediate review of Teams external communication policies.
◈ Table of Contents
Phase 1 — Threat Actor Profile
APT / MOIS| Attribute | Detail |
|---|---|
| Primary Name | MuddyWater |
| Aliases | Mango Sandstorm, Seedworm, Static Kitten, MERCURY, TA450 |
| Sponsor | Iranian Ministry of Intelligence and Security (MOIS) |
| Active Since | 2017 (ongoing; increased tempo in 2026) |
| Primary Objective | Cyber-espionage, credential theft, pre-positioning for disruptive operations |
| Primary Targets | US, Israeli, and Western European organizations; government, defense, critical infrastructure, construction, manufacturing |
| Signature Tools | Ligolo-ng, DWAgent, AnyDesk, pythonw.exe injection, custom PowerShell loaders |
| False Flag Tactic | Chaos ransomware deployed post-espionage to overwrite forensic artifacts and generate misleading attribution |
MuddyWater has a documented history of false flag operations — they previously used BlackShadow and DEV-0228 personas. Chaos ransomware does not represent a pivot to financially motivated crime; it is an operational security tool used to burn evidence and misdirect incident response.
Phase 2 — Victims & Targeting
36 confirmedAs of late March 2026, the Chaos ransomware leak site listed 36 victims. Rapid7's assessment is that a subset of these were actual MuddyWater intrusions masked under the Chaos brand. Targeting skews heavily toward US organizations across sectors where sensitive project, contract, and personnel data has intelligence value to Iranian state interests.
Construction & Engineering
Defense contractor subcontractors and engineering firms hold sensitive project specifications, personnel clearance data, and government contract details — high-value targets for MOIS.
Manufacturing
Industrial manufacturers with US Department of Defense supply chain relationships represent strategic intelligence value. Credentials from these environments can enable lateral access to prime contractors.
Government Contractors
Organizations providing services to US federal agencies face direct targeting. MuddyWater prioritizes credential access to cloud environments hosting government data.
Phase 3 — TTPs & Kill Chain
T1566 → T1486| MITRE Technique | ID | Observed Behavior |
|---|---|---|
| Phishing via Service | T1566.003 | External Teams chat requests to employees from attacker-controlled accounts |
| Valid Account Abuse | T1078 | Harvested credentials used to authenticate to corporate cloud and VPN resources |
| Remote Access Software | T1219 | AnyDesk and DWAgent deployed for persistent interactive access |
| Input Capture | T1056 | Victims tricked into typing credentials into local text files during screen-sharing |
| Modify Auth Process | T1556 | MFA settings modified to add attacker-controlled authentication methods |
| Process Injection | T1055 | pythonw.exe used to inject code into suspended processes |
| Data Encrypted for Impact | T1486 | Chaos ransomware deployed as final-stage false flag to destroy forensic artifacts |
| Indicator Removal | T1070 | Ransomware deployment triggers victim IR response that inadvertently destroys evidence |
Phase 4 — Indicators of Compromise
Rapid7 ResearchThese IOCs are sourced from Rapid7's published research. Threat actor infrastructure rotates frequently — treat domains and IPs as high-confidence historical indicators, not guaranteed live C2. Block and hunt; do not rely solely on this list.
| Type | Indicator | Context |
|---|---|---|
| Domain (C2) | moonzonet[.]com | MuddyWater C2 domain active in early 2026 campaigns targeting Israeli and Western organizations |
| Malware Loader | ms_upd.exe | Drops custom backdoor; disguised as a Microsoft update component |
| Backdoor | Game.exe | Custom backdoor disguised as Microsoft WebView2 application; supports 12 C2 commands including PowerShell execution, file upload/delete, persistent shell |
| RAT / Persistence | DWAgent, AnyDesk | Legitimate remote management tools abused for persistent interactive access post-compromise |
| Injection Process | pythonw.exe | Signature MuddyWater technique — pythonw.exe used to inject shellcode into suspended processes |
| Ransomware | Chaos ransomware variants | Deployed as terminal false flag; not used for ransom collection — used to destroy forensic artifacts |
Phase 5 — Detection Logic
KQL / SigmaPhase 6 — Hunt Recommendations
Blue Team- 1In Teams Admin Center, navigate to Users > External Access and restrict to allow-listed domains only.
- 2Enable External access warnings so employees see a banner when chatting with non-organizational accounts.
- 3Block screen sharing requests from external participants in meeting policies unless explicitly whitelisted.
- 1In Entra ID (Azure AD) audit logs, query
Add registered owner to deviceandRegister user devicefor anomalous additions. - 2Alert on MFA registration from IPs that do not match the user's normal access geography.
- 3Implement Privileged Identity Management (PIM) requiring approval for MFA method changes.
- 1Query your EDR for
anydesk.exe,DWAgent.exe,dwrcs.exewith installation timestamps in the past 90 days. - 2Cross-reference against your approved software inventory — any unlisted installation warrants immediate investigation.
- 3Check for outbound connections from these processes to IPs or domains outside your normal operational geography.
If you discover Chaos ransomware artifacts on a host during investigation, do NOT immediately conclude this is a financially motivated ransomware incident. Preserve forensic copies of affected volumes before any remediation — the ransomware is a terminal stage false flag deployed to destroy evidence of prior espionage activity. Treat the encrypted host as potentially the least important system; the real damage occurred earlier in the intrusion.
Phase 7 — Sources & References
7 sources🚨 THREAT ACTOR TRACKING
Use the CyberHawk Threat Intel actor database to track MuddyWater IOCs, campaign timelines, and affiliated infrastructure. New indicators from this campaign are being added in real time.
◈ Stay Connected
Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.
"They can't exploit you if you are the Exploit."