Iran-Linked APT Posed as Chaos Ransomware Member in Espionage Campaign

Rapid7 reports that Iranian-linked APT MuddyWater conducted a false-flag intrusion in early 2026 by impersonating Chaos ransomware affiliates to mask intelligence-driven espionage and prepositioning. The intrusion leveraged interactive Microsoft Teams social engineering to harvest credentials and manipulate MFA, established persistence with remote access tools (DWAgent, AnyDesk), exfiltrated legitimate data, and initiated extortion behaviors without deploying a ransomware payload; investigators found links to prior MuddyWater infrastructure including a code-signing certificate, the moonzonet.com domain, and specific process injection techniques.