Iranian APT MuddyWater Masquerades as Chaos Ransomware in Elaborate False Flag

Rapid7 investigators determined an intrusion masquerading as Chaos ransomware was in fact a MuddyWater (Seedworm) operation: attackers used Microsoft Teams screen-sharing and social engineering to harvest credentials and bypass MFA, deployed a custom RAT ('Game.exe') and DWAgent for persistence, exfiltrated data rather than encrypting files, and staged ransomware-themed extortion to obfuscate attribution; forensic ties include a known MuddyWater code-signing certificate issued to "Donald Gay" and overlapping C2 infrastructure.