Full Report
A cyber intrusion initially presented as a conventional Chaos ransomware attack has now been linked with moderate confidence... The post Rapid7 links Chaos ransomware campaign to Iranian state-sponsored MuddyWater espionage operation appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: MuddyWater
## Attribution & Identity
* **Primary Name:** MuddyWater
* **Aliases/Associated Groups:** Seedworm, Mango Sandstorm (implied by Iranian MoIS association)
* **Known Associations:** Linked with high confidence to the Iranian Ministry of Intelligence and Security (MOIS).
* **False Flag Association:** Recent campaigns utilized "Chaos" ransomware branding (a Ransomware-as-a-Service operation likely composed of former BlackSuit or Royal members) to mask their true identity.
## Activity Summary
Rapid7 identified an espionage campaign beginning in 2025/early 2026 that initially appeared to be a standard Chaos ransomware attack. However, investigation revealed it was a MuddyWater operation using ransomware as a "false flag" to obscure espionage, credential harvesting, and long-term data exfiltration. The actor prioritized internal network manipulation and sensitive data theft over the typical high-volume encryption associated with ransomware.
## Tactics, Techniques & Procedures
* **Initial Access:**
* Social Engineering via Microsoft Teams.
* Voice-based Phishing (Vishing) impersonating IT support.
* Spam email flooding.
* **Persistence & Remote Access:**
* Abuse of legitimate remote management tools: AnyDesk, DWAgent, and Microsoft Quick Assist.
* Interactive screen sharing.
* **Execution & Evasion:**
* Use of the ‘Donald Gay’ code-signing certificate (associated with previous MOIS operations).
* MFA (Multi-Factor Authentication) manipulation to maintain long-term access.
* Use of Chaos ransomware branding to complicate attribution and disrupt forensic analysis.
* **Data Exfiltration:** Focused on sensitive information and big-game hunting (BGH) data collection.
## Targeting
* **Sectors:** Critical infrastructure, Defense supply chain, Government, and Industrial sectors.
* **Geography:** Primarily Western and Middle Eastern networks (specifically noted: Israel, USA, and Egypt in historical/related contexts).
* **Victims:** US infrastructure and defense supply chain networks; organizations in Israel and Egypt.
## Tools & Infrastructure
* **Malware:**
* **Chaos Ransomware:** Used for branding and diversionary encryption.
* **BugSleep:** New backdoor mentioned as part of the actor's 2026 arsenal.
* **Legitimate Software: AnyDesk, DWAgent, Microsoft Teams, Microsoft Quick Assist.
* **Infrastructure:**
* C2 infrastructure previously linked to Seedworm/MuddyWater operations.
* Digital Certificates: "Donald Gay" code-signing certificate.
* *Note: Specific defanged IPs/URLs were not provided in the source text.*
## Implications
* **Strategic Obfuscation:** The transition to "false flag" ransomware tactics suggests a sophisticated evolution where state actors use the "noise" of the cybercriminal ecosystem to hide targeted espionage.
* **Prepositioning:** The actor is likely prepositioning for potential disruptive operations across Western and Middle Eastern critical infrastructure.
* **Attribution Challenges:** By adopting the TTPs of RaaS groups like Chaos (linked to former BlackSuit/Royal members), MuddyWater increases the difficulty for incident responders to identify the strategic intent of an intrusion.
## Mitigations
* **Social Engineering Defense:** Implement strict verification protocols for IT support calls and Microsoft Teams messages coming from outside the organization.
* **Remote Tool Control:** Restrict or monitor the use of remote management software (AnyDesk, DWAgent, Quick Assist) to authorized administrative accounts only.
* **MFA Hardening:** Monitor for unauthorized changes to MFA settings and implement FIDO2-based hardware tokens to resist phishing.
* **Certificate Auditing:** Block or alert on binaries signed with known compromised or suspicious certificates (e.g., the "Donald Gay" certificate).