Iranian hackers masqueraded as different hackers to mask spying effort

Iranian state-backed hackers posed as members of a ransomware gang in an apparent attempt to disguise a broader cyber-espionage operation, according to a new report.

Researchers at Rapid7 said the campaign, uncovered during an intrusion at an unnamed organisation earlier this year, bore the hallmarks of the Iranian-linked group MuddyWater , which has previously been associated with the country's Ministry of Intelligence and Security.

The attackers allegedly masqueraded as affiliates of the Chaos ransomware operation, blending extortion tactics with covert intelligence gathering in what analysts called a "hybrid intrusion model."

According to the report , the breach began with a social engineering approach over Microsoft Teams.

Attackers contacted employees through one-on-one chats and persuaded at least some victims to participate in screen-sharing sessions.

During those sessions, the hackers reportedly searched for VPN-related files, instructed employees to type credentials into locally created text documents, and in some cases installed remote access software including AnyDesk.

Rapid7 said the attackers quickly escalated their access using compromised legitimate accounts, while also manipulating multi-factor authentication systems to maintain persistence inside the victim network.

The group later deployed additional remote management tools, including DWAgent, before exfiltrating data and contacting the organisation with ransom demands.

However, researchers noted several inconsistencies with typical ransomware operations.

Although the attackers claimed affiliation with Chaos ransomware and published stolen data on the group's leak site, investigators said no ransomware payload was ever deployed - an unusual omission for financially motivated cybercriminals.

The attackers referenced a ransom note containing credentials for a secure negotiation channel, but investigators were unable to locate the file.

Rapid7 linked the operation to MuddyWater through several technical indicators, including overlaps in command-and-control infrastructure, malware execution techniques, and the use of Microsoft Teams sessions to harvest credentials and bypass MFA protections.

The report also identified a code-signing certificate labelled "Donald Gay" and infrastructure tied to the domain "moonzonet[.]com", both allegedly connected to MuddyWater activity.

Cybersecurity experts said the apparent use of a ransomware brand as cover may have been intended to complicate attribution and delay defensive responses.

"The use of a RaaS framework in this context may enable the actor to blur distinctions between state- activity and financially motivated cybercrime, thereby complicating attribution," Rapid7 said in the report.

Researchers warned that organisations should not assume extortion is the primary objective just because ransomware tactics are observed.

Instead defenders should examine the full intrusion lifecycle, particularly where enterprise collaboration platforms, credential theft and legitimate remote administration tools are involved.

MuddyWater has previously been accused of using criminal ransomware ecosystems as camouflage. The group was linked to activity involving the Qilin ransomware operation during an attack on an Israeli organisation in late 2025.

"Ultimately, this activity is best understood as a hybrid intrusion model, in which ransomware is leveraged not as an end goal but as a mechanism for concealment, coercion, and operational flexibility within a broader intelligence-driven campaign," the researchers said.

"Techniques such as social engineering via enterprise communication platforms, credential harvesting with MFA manipulation, and the abuse of legitimate remote access tools remain critical enablers of compromise."