Iran-Linked MuddyWater Poses as Ransomware Gang to Mask Cyber Espionage

### Executive summary: NCC Group reports that Iran-linked APT MuddyWater has been masquerading as the Chaos ransomware group to conceal espionage activity, leveraging extortion notes, leak sites and criminal infrastructure; the report warns that multiple state-backed actors are increasingly adopting cybercriminal tooling, RaaS and dark-web malware to gain plausible deniability and recommends behavioral and operational detection over signature-based methods.