MuddyWater APT Fakes Chaos Ransomware in Iran-Linked Breach

The Iran-linked APT group MuddyWater conducted an elaborate cyber espionage operation disguised as a Chaos ransomware attack in early 2026, according to Rapid7 security researchers. The attackers performed reconnaissance, credential harvesting, and data theft but never deployed file-encrypting ransomware, suggesting the Chaos artifacts were planted as false flags to hide state-sponsored activity.

The operation demonstrates how nation-state actors increasingly mimic cybercriminal tactics to obscure their true objectives and attribution.

Social Engineering Through Microsoft Teams

MuddyWater gained initial access through social engineering tactics targeting employees via Microsoft Teams. The attackers established screen-sharing sessions that provided direct access to user assets and corporate systems.

During these sessions, threat actors executed basic discovery commands and accessed files related to the victim’s VPN configuration. They instructed users to enter credentials into locally created text files, effectively bypassing traditional security controls through human manipulation.

“While connected, the TA executed basic discovery commands, accessed files related to the victim’s VPN configuration, and instructed users to enter their credentials into locally created text files,” Rapid7 reported. The attackers also deployed AnyDesk remote management software to maintain persistent access.

Persistent Access and Lateral Movement

After establishing initial foothold, MuddyWater created persistent access through RDP sessions and the DWAgent remote access tool. This dual-channel approach ensured continued network access even if one method was discovered and blocked.

The attackers used their persistent access to deploy additional payloads, move laterally through the compromised environment, and systematically harvest sensitive information. The operation followed standard APT playbooks focused on intelligence gathering rather than financial gain.

The group’s sophisticated approach included manipulating multi-factor authentication protections and compromising multiple user accounts to expand their network presence.

Extortion Campaign Mimics Ransomware Groups

In the final phase, MuddyWater sent extortion emails to multiple users claiming to have stolen sensitive information and threatening public disclosure unless ransom demands were met. The emails directed victims to the Chaos ransomware leak site, where the targeted organization appeared as a new victim.

A subsequent email instructed recipients to locate a note containing credentials for secure chat negotiations, but the note was never found. The stolen data was ultimately leaked online, consistent with typical ransomware group behavior.

However, investigators found no evidence of actual file-encrypting ransomware deployment on compromised machines, confirming the Chaos ransomware connection was fabricated.

Broader Ransomware Enforcement Actions

The MuddyWater operation occurred amid increased law enforcement activity against ransomware groups. Deniss Zolotarjovs, a 35-year-old Latvian member of the Karakurt ransomware gang, was sentenced to 8.5 years in federal prison for his role in extorting victims.

Zolotarjovs served as a negotiator for Karakurt between June 2021 and March 2023, during which the group targeted at least 53 entities and caused $56 million in losses. Court documents show he received 10% of negotiated ransom payments in cryptocurrency, which he converted to Russian rubles through multiple wallet transfers.

Karakurt, also known as TommyLeaks and associated with the Conti group, was notorious for stealing personally identifiable information and disrupting critical infrastructure, including a 911 emergency system.

Supply Chain Attacks Target Security Firms

Cybersecurity companies faced multiple high-profile breaches in recent months. The RansomHouse group claimed responsibility for attacking Trellix, breaching part of the company’s source code repository. Trellix stated no evidence suggested their source code release or distribution process was affected.

RansomHouse published screenshots showing access to internal services and management dashboards but has not specified the volume or type of stolen data. The attack timing suggests potential connections to recent supply chain campaigns linked to TeamPCP and Lapsus$ groups.

Checkmarx suffered a separate supply chain attack affecting its Jenkins AST plugin. Malicious versions were published to the Jenkins Marketplace as part of ongoing compromise dating to March 2026, when TeamPCP accessed company repositories through the Trivy supply chain attack.

Education Sector Under Siege

The education technology sector experienced significant disruption when Canvas, used by over 8,800 schools according to attacker claims, was forced into maintenance mode following a breach by the ShinyHunters group. The attack affected universities including Harvard, Columbia, Rutgers, and Georgetown during critical end-of-year periods.

Instructure, Canvas’s maker, confirmed the breach exposed user names, email addresses, student ID numbers, and platform messages for users at affected institutions. The timing during finals and assignment deadlines amplified the attack’s impact across the education sector.

The incident represents one of the most widespread disruptions to educational operations from a single platform breach.

What This Means

The MuddyWater campaign illustrates how nation-state actors increasingly adopt cybercriminal tactics to obscure attribution and complicate incident response. By mimicking ransomware operations while conducting espionage, state-sponsored groups can delay proper attribution and response measures.

The convergence of APT and ransomware tactics creates new challenges for defenders who must simultaneously prepare for profit-motivated criminals and state-sponsored intelligence operations. Organizations should implement comprehensive logging and behavioral analysis to distinguish between genuine ransomware attacks and state-sponsored operations masquerading as criminal activity.

The recent enforcement actions against ransomware operators demonstrate growing international cooperation in disrupting cybercriminal networks, though state-sponsored groups remain largely beyond traditional law enforcement reach.

FAQ

How can organizations distinguish between real ransomware and fake campaigns?
Look for inconsistencies in attacker behavior, such as sophisticated reconnaissance without file encryption, or extortion demands that don’t align with typical ransomware group patterns. Comprehensive endpoint detection and behavioral analysis can identify these discrepancies.

What should educational institutions do to protect against platform-wide attacks?
Implement backup communication and learning management systems, establish incident response procedures for vendor breaches, and maintain offline copies of critical educational materials. Regular vendor security assessments are essential for third-party risk management.

Why are cybersecurity companies increasingly targeted in supply chain attacks?
Security firms provide attractive targets because compromising their products can affect thousands of downstream customers simultaneously. Their repositories often contain valuable source code and security research that benefits both cybercriminals and nation-state actors.