Iranian APT Intrusion Masquerades as Chaos Ransomware Attack
The Iran-linked APT actor MuddyWater has been observed performing an intrusion masquerading as a ransomware attack, Rapid7 reports.
As part of the intrusion observed in early 2026, the attackers relied on social engineering for initial access and performed operations typically associated with espionage campaigns, including reconnaissance, credential harvesting, and data theft, but did not deploy file-encrypting ransomware.
The threat actors engaged with the victim organization’s employees via Microsoft Teams, establishing screen-sharing sessions for access to users’ assets. This allowed them to steal credentials, manipulate MFA protections, and compromise accounts.
“While connected, the TA executed basic discovery commands, accessed files related to the victim’s VPN configuration, and instructed users to enter their credentials into locally created text files. In at least one instance, the TA also deployed a remote management tool (AnyDesk) to further facilitate access,” Rapid7 says.
Next, the attackers established persistent access through RDP sessions and the DWAgent remote...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
