INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Iran-Linked APT Exploits Chaos Ransomware Tactics

| 2026-05-06 13:00 CRITICAL MEDIUM RANSOMWARE & EXTORTION STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
The threat actor behind the recent Chaos ransomware campaign, linked to Iran's Ministry of Intelligence and Security, has been revealed through a new report by security vendor Rapid7. The intrusion began with social engineering via Microsoft Teams screen sharing, followed by an "obfuscation can't hide" approach that used a countdown timer to conceal data exfiltration. This hybrid model leveraged ransomware as a means for plausible deniability and operational flexibility within a broader intelligence-driven campaign.
Technical Mitigations AI-generated
• Implement secure authentication and authorization mechanisms to prevent unauthorized access to systems, such as MFA (Multi-Factor Authentication) for all users. • Regularly update software and operating systems with the latest security patches and updates to fix known vulnerabilities. • Use secure communication protocols, such as encrypted email or messaging apps, when communicating sensitive information. • Monitor system logs and network traffic for suspicious activity, which can help detect potential intrusion attempts.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
py•••••.exe
AI Podcast (EN) detail_available
detail_listen_ai (EN)
Intelligence distributed on:
Incident Link
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
MuddyWaterMuddyWater Pay2KeyPay2KeyQilinQilin
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DPRK DPRK governmentgovernment healthhealth
Incident Timeline
‎February 2025
Iranian government hackers used the Chaos ransomware operation.
tactic Ransomware
The Chaos ransomware operation has existed since February 2025 and cybersecurity experts believe it was created by former members of the now-defunct BlackSuit and Royal ransomware groups.
organisation BlackSuit
The Chaos ransomware operation has existed since February 2025 and cybersecurity experts believe it was created by former members of the now-defunct BlackSuit and Royal ransomware groups.
‎2025/05/07
Iranian government hackers used the MuddyWater ransomware strain to target an Israeli organization in May 2025.
tactic Ransomware
Researchers last year tied MuddyWater to the Qilin ransomware ecosystem after the strain was used to attack an Israeli organization.
threat_actor MuddyWater
Researchers last year tied MuddyWater to the Qilin ransomware ecosystem after the strain was used to attack an Israeli organization.
malware Qilin
Researchers last year tied MuddyWater to the Qilin ransomware ecosystem after the strain was used to attack an Israeli organization.
target_region Israel
Researchers last year tied MuddyWater to the Qilin ransomware ecosystem after the strain was used to attack an Israeli organization.
‎late 2025
Iranian government hackers used Chaos Ransomware to target an Israeli organization, Rapid7 reported.
malware Qilin
In late 2025 it was linked to activity involving the Qilin RaaS ecosystem in an attack targeting an Israeli organization, Rapid7 noted.
source_region Israel
In late 2025 it was linked to activity involving the Qilin RaaS ecosystem in an attack targeting an Israeli organization, Rapid7 noted.
‎May 6
Iranian government hackers used Chaos ransomware.
tactic Ransomware
The security vendor made the revelations in a new report published on May 6, Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware.
‎2026/05/06
Iranian government hackers used Chaos ransomware to target a US healthcare organization in late February.
organisation Espionage Campaign
Iran-Linked APT Posed as Chaos Ransomware Member in Espionage Campaign.
threat_actor MuddyWater
Incident responders from cybersecurity firm Rapid7 published a report about a recent intrusion that initially appeared to be a Chaos ransomware attack but was later discovered to be an attack attributed to MuddyWater, an Iranian APT group tied to the country’s Ministry of Intelligence and Security (MOIS).
The malware deployed and certificates used tied back to the toolkit typically used by Iran’s MuddyWater hacking group.
Aside from this unusual behavior, Rapid7 discovered several links to previous infrastructure used by MuddyWater including: A code-signing certificate (“Donald Gay”) used to validate the malware samples The moonzonet[.]com domain, which supported command-and-control (C2) infrastructure Use of pythonw.exe to inject code into suspended processes Use of interactive Microsoft Teams sessions to harvest MFA and credentials MuddyWater has previous when it comes to impersonating RaaS groups.
The infrastructure used in the attack was previously tied by security vendors to another MuddyWater campaign identified in March targeting organizations in the Middle East and North Africa.
organisation DLS
Obfuscation Can’t Hide Iran Links Although the threat actor alleged successful data exfiltration, the Chaos group operates a “blind” countdown timer, meaning no victim details could be viewed on the RaaS outfit’s data leak site (DLS).
organisation Microsoft
The intrusion itself, which took place at an unnamed organization, began with social engineering of an employee via Microsoft Teams screen sharing.
organisation Microsoft Teams
Rapid7 provided little information about the victim at the center of the incident, only writing that the hackers used a social engineering campaign leveraging Microsoft Teams to gain initial access.
Aside from this unusual behavior, Rapid7 discovered several links to previous infrastructure used by MuddyWater including: A code-signing certificate (“Donald Gay”) used to validate the malware samples The moonzonet[.]com domain, which supported command-and-control (C2) infrastructure Use of pythonw.exe to inject code into suspended processes Use of interactive Microsoft Teams sessions to harvest MFA and credentials MuddyWater has previous when it comes to impersonating RaaS groups.
organisation AnyDesk
“Furthermore, the inclusion of extortion and negotiation elements could serve to focus defensive efforts on immediate impact, likely delaying the identification of underlying persistence mechanisms established via remote access tools such as DWAgent or AnyDesk.”
organisation MFA
“By operating interactively through compromised users, the attacker [TA] conducted initial discovery, harvested credentials, including MFA manipulation, and quickly transitioned to using legitimate accounts for internal access,” Rapid7 explained.
organisation TA
“From there, the TA established persistence using remote access tools such as DWAgent and AnyDesk, before deploying additional payloads and further control of the environment.
organisation DWAgent
“From there, the TA established persistence using remote access tools such as DWAgent and AnyDesk, before deploying additional payloads and further control of the environment.
‎early 2026
Rapid7 branded an intrusion as a false flag operation by the MuddyWater group affiliated with Iran's Ministry of Intelligence and Security.
threat_actor MuddyWater
Rapid7 branded an intrusion which occurred in early 2026 as a false flag operation by the MuddyWater (aka Seedworm, Static Kitten and Mango Sandstorm) group affiliated with the Iranian Ministry of Intelligence and Security.
“While attribution evasion is a common characteristic of state-affiliated actors, MuddyWater’s reported increase in operational activity as of early 2026, primarily involving cyber espionage and potential prepositioning for disruptive operations across Western and Middle Eastern networks, has likely intensified its reliance on deceptive false-flag operations,” the two said.
attribution Seedworm
Rapid7 branded an intrusion which occurred in early 2026 as a false flag operation by the MuddyWater (aka Seedworm, Static Kitten and Mango Sandstorm) group affiliated with the Iranian Ministry of Intelligence and Security.
attribution the Iranian Ministry of Intelligence and Security
Rapid7 branded an intrusion which occurred in early 2026 as a false flag operation by the MuddyWater (aka Seedworm, Static Kitten and Mango Sandstorm) group affiliated with the Iranian Ministry of Intelligence and Security.
tactic Espionage
“While attribution evasion is a common characteristic of state-affiliated actors, MuddyWater’s reported increase in operational activity as of early 2026, primarily involving cyber espionage and potential prepositioning for disruptive operations across Western and Middle Eastern networks, has likely intensified its reliance on deceptive false-flag operations,” the two said.
Intelligence Sources
TheRecord 2026-05-07
Infosecurity-Magazine 2026-05-06
Infosecurity-Magazine 2026-05-06