Iranian cyber espionage disguised as a Chaos Ransomware attack

Rapid7 uncovered a 2026 campaign where the Iran-linked APT MuddyWater masqueraded as the Chaos ransomware group to conceal espionage: attackers used Microsoft Teams social engineering to obtain screen sharing and credentials, deployed remote access tools (AnyDesk, DWAgent), installed backdoors (Dindoor, Fakeset), exfiltrated data (Rclone to cloud storage), and staged extortion/ leak site activity as a false flag, with artifacts (code-signing certificates, C2 infrastructure) supporting moderate-confidence attribution to MuddyWater.