Back Securityaffairs.Co

Iranian cyber espionage disguised as a Chaos Ransomware attack

Securityaffairs.Co •Pierluigi Paganini • May 6, 2026

Iran-linked APT MuddyWater used ransomware-style tactics to mask espionage, combining phishing, credential theft, data exfiltration, and extortion without encryption. A newly discovered cyber intrusion attributed to the Iran-linked APT MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) reveals how state- attackers are increasingly leveraging ransomware tactics to disguise espionage operations. The campaign, uncovered by security researchers at Rapid7, blended […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian APT MuddyWater Uses Chaos Ransomware as a False Flag for Espionage In early 2026, the Iranian APT group MuddyWater, affiliated with the Ministry of Intelligence and Security, executed a sophisticated cyber operation disguised as a Chaos ransomware attack. Utilizing social engineering tactics via Microsoft Teams, they gained access to an unnamed organization's systems, harvesting credentials and manipulating multi-factor authentication (MFA). The attackers established persistence using remote access tools like DWAgent and AnyDesk, focusing on data exfiltration rather than traditional ransomware tactics. This operation is characterized as a false flag, aimed at masking espionage activities while complicating attribution. Rapid7's analysis revealed specific technical artifacts linking the incident to MuddyWater, including a unique code-signing certificate. The campaign reflects a growing trend of state-sponsored actors adopting criminal methodologies to obscure their true intentions. The incident highlights the need for defenders to look beyond conventional ransomware indicators to identify underlying threats. 17 sources 76

Extracted Entities

Iranian cyber espionage disguised as a Chaos Ransomware attack

The full story

Extracted Entities

APT Groups (6)

Attack Types (2)

MITRE ATT&CK (4)

Ransomware Groups (1)