MuddyWater Behind Chaos Ransomware: Iranian Espionage Masquerading as Ransomware via Microsoft Teams

This intrusion set operates under the Chaos ransomware-as-a-service brand and displays the outward indicators of an extortion operation, including data-leak-site branding and ransom demands. Its observed behavior differs from a typical ransomware incident in that the operators do not encrypt files, and instead conduct credential theft, hands-on lateral movement, and the establishment of durable remote access. This pattern is consistent with a data-theft and access-retention operation that uses ransomware branding as cover. Observed targeting spans organizations in the United States, Israel, and the wider Middle East, across the construction, manufacturing, and business services sectors. Infrastructure and tradecraft overlap, with moderate confidence, with Iranian state-aligned espionage activity tracked as MuddyWater.

Initial access is obtained through social engineering over Microsoft Teams. Operators send external chat requests while impersonating internal IT or help-desk personnel, then move targets into interactive screen-sharing sessions. During these sessions the operators harvest credentials, direct users to enter credentials into locally created text files, and modify multi-factor authentication by registering attacker-controlled devices. Using the harvested credentials, the operators authenticate to internal systems and remote-access gateways and establish persistence with legitimate remote-management software, primarily DWAgent and AnyDesk, installed as services and staged in non-standard directories to resemble legitimate software.

Alongside the legitimate tooling, the operators deploy custom malware. A lightweight downloader tracked as Stagecomp, retrieved from attacker infrastructure, delivers a custom remote access trojan tracked as Darkcomp that impersonates a Microsoft WebView2 application, built from a trojanized sample project and signed with a revoked code-signing certificate. The implant employs multiple defense-evasion measures, including runtime resolution of its capabilities, sandbox and virtualization checks prior to execution, and an encrypted configuration file. The operators execute sequences of native discovery commands, move laterally using remote desktop and virtual private network access with the compromised accounts, and communicate with command-and-control infrastructure over HTTPS at a fixed polling interval, exfiltrating collected data over the same channel. No file-encryption payload has been observed across these intrusions, consistent with objectives of data theft and persistent access rather than service disruption.