Rapid7 Links MuddyWater to US Ransomware Espionage

Security researchers at Rapid7 have attributed a series of cyber intrusions in early 2026 to the Iranian state-sponsored group MuddyWater, also known as Seedworm, Mango Sandstorm, Static Kitten and other aliases, which masqueraded as a Chaos ransomware attack to conduct espionage.

The intrusions targeted U.S. organizations, including a bank, an airport, nonprofits and a software supplier with operations in Israel. Attackers gained initial access through social engineering on Microsoft Teams, posing as internal IT staff or associates to initiate chats and screensharing sessions with employees. During these interactions, they executed reconnaissance commands, accessed VPN configuration files, tricked users into saving credentials in text files and, in some cases, installed remote access tools like AnyDesk.

Once inside, the intruders established persistence using tools such as DWAgent and Remote Desktop Protocol sessions. They deployed secondary payloads, including malware signed with code-signing certificates previously linked to MuddyWater, such as those attributed to Donald Gay and Amy Cherne. These included a loader called ms_upd.exe, custom backdoors like Dindoor and Fakeset,...