Iran cybersnoops still LARPing as ransomware crooks in espionage ops

Rapid7 researchers observed activity attributed with medium confidence to the Iran-linked MuddyWater group that impersonated the Chaos ransomware gang to conceal espionage operations: attackers used Microsoft Teams phishing and social engineering to harvest credentials and modify MFA settings, deployed a Darkcomp backdoor and a malicious WebView2 loader via RDP-delivered payloads, moved laterally to collect sensitive data, and published the stolen data on a Chaos data leak site without performing file encryption or seeking a ransom — indicating a false-flag cyberespionage operation and possible prepositioning for destructive actions.