- Iran-based attackers deploy Chaos ransomware as cover for espionage, with Rapid7 tracing the attack to MuddyWater, an APT group linked to the country’s Ministry of Intelligence and Security.
- The attackers gained initial access using Microsoft Teams, initiating external chats, setting up screen-sharing sessions, accessing VPN files, and tricking employees into entering credentials.
- The absence of file encryption led researchers to question the true culprit, technical evidence includes malware and certificates tied the operation directly to Iran’s MOIS.
Nation-State hackers of the Iranian Government have deployed Chaos Ransomware to hide their espionage operations. Rapid7 Security researchers found this to be the case through their research into a hacking operation that at first appeared to be a simple ransomware incident.
Through responders to the incident, the attack points back to MuddyWater, an Iranian-based advanced persistent threat group affiliated with the Ministry of Intelligence and Security (MOIS) in the country. By using the Chaos Ransomware brand, the hackers tried to obfuscate their intentions and make attribution much more difficult for Western investigators.
Rapid7’s Alexandra Blia and Ivan Feigl wrote that this approach reflects a consistent effort to hide operational goals and complicate the attribution process. The researchers noted that MuddyWater has reportedly increased its cyber espionage activities targeting Western and Middle Eastern networks since early 2026.
Attackers Used Microsoft Teams in Clever Social Engineering Scheme
The Rapid7 report provided limited details about the victim organization. However, the researchers described how the hackers gained initial network access through a Microsoft Teams social engineering campaign.
The threat actors contacted employees using external chat requests and started one-on-one conversations with their targets. After they established contact with the victims, they set up screen sharing sessions where they obtained files pertaining to the victims’ VPN settings and requested the victims to enter in their credentials.
Additionally, hackers used a remote-control management tool that allowed them deeper penetration into the target systems. The attackers sent numerous e-mails directly to employees, under the threat of releasing the stolen data if the company fails to pay a ransom prior to a set period.
The attempted extortion of the company through the e-mails appeared to have poor coordination and execution. However, the hackers later released stolen data that the company confirmed as legitimate. Rapid7 noted that the absence of file encryption stood out as another inconsistency, leading them to question who truly ran the operation.
Technical Evidence Points Clearly to Iran’s Intelligence Ministry
The investigation uncovered large amounts of technical evidence linking this attack to the Iranian Ministry of Intelligence. The malware and digital certificates in the attack matched a toolset that was previously used in ‘MuddyWater’ campaigns.
Additionally, the infrastructure applicable to this attack was the same in a MuddyWater campaign that occurred in March of 2026, targeting organizations throughout the Middle East and North Africa. This connection strengthened the attribution to Iranian state actors.
According to Rapid7, this incident illustrates the increasing convergence between state-sponsored intrusions and techniques that cybercriminals employed. The researchers noted that there were indications of a connection between MDRS and the Qilin Ransomware ecosystem last year.
After investigators directly attributed that attack to Iran’s MOIS, the hackers likely adopted the Chaos ransomware prototype to cut down attribution risk and ensure plausible deniability.
Ransomware Helps Nation-States Blur Their Motivations
Multiple state-sponsored groups from China, Russia, North Korea, and Iran have adopted ransomware-as-a-service frameworks, some use these tools as cover for espionage, while others use them to disrupt adversaries.
Ransomware allows state actors to muddy their motivations; it becomes harder for Western law enforcement and cyber defenders to categorize attacks correctly. Researchers warned in February that North Korean state hackers now use Medusa ransomware in their operations. Other cases have shown ransomware serving as cover for Chinese espionage activity.
The FBI has seen Iranian actors collaborating with affiliates of the Ransomhouse, NoEscape, and AlphV ransomware operations. The Iranian hackers reportedly took a percentage of ransom payments from these collaborations.
When kinetic hostilities escalated between Iran and the United States, a flurry of cyber activity followed. Iranian actors launched alleged ransomware attacks and wiper incidents. A US healthcare organization faced Iran’s Pay2Key ransomware in late February, while a prominent medical device company suffered weeks of disruption following an Iranian cyberattack.
The Iranian cyber threat extends beyond ransomware-covered espionage and attacks on US targets. In a separate but related development, Iran-linked hackers have claimed breaches of Israeli intelligence and military systems, highlighting the broader regional scope of Iranian cyber operations. Read the full story, Iran-linked hackers claim breaches of Israeli Intelligence and military systems.
