Iranian hackers launch ransomware campaign looking to steal details via Microsoft Teams
- Iranian APT MuddyWater posed as IT staff via Microsoft Teams, tricking victims into granting remote access
- They deployed infostealers, altered MFA, exfiltrated data, and staged a Chaos ransomware infection as cover
- Researchers concluded the true motive was espionage, not profit, highlighting state‑sponsored tradecraft overlap with criminal tactics
Iranian state-sponsored hackers ran a cyber-espionage campaign, and then tried to throw investigators off track with a ransomware infection, experts have warned.
An investigation into a recent attack from security researchers Rapid7 found how an unnamed victim was recently approached via Microsoft Teams, by someone from outside their organization. They posed as IT technicians, discussed solving a technical problem with the victim, and managed to get them to install and run an AnyDesk session.
After getting remote access, they deployed different malware and infostealer variants, harvesting credentials and modifying multi-factor authentication (MFA) settings, establishing persistence, and exfiltrating sensitive information from the now-compromised endpoints.
...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
