MuddyWater Uses Microsoft Teams for Ransomware Attack, Employs Chaos Decoy
Patch Microsoft Teams to block unsolicited chat invitations and enforce MFA to prevent credential theft.
Configure Microsoft Teams to block external chat invites, enforce MFA, and monitor for RDP/DWAgent/AnyDesk usage.
Summary
In early 2026, the Iranian state‑sponsored hacking collective known as MuddyWater (also called Mango Sandstorm, Seedworm and Static Kitten) carried out a sophisticated ransomware operation that has been described as a false‑flag campaign. Rapid7’s threat‑intel team uncovered the attack, noting that the attackers began by sending a seemingly innocuous Microsoft Teams message to targeted users. The message contained a malicious attachment or link that, once opened, deployed ransomware payloads across the victim’s network. The use of Teams—a widely adopted collaboration platform—illustrates MuddyWater’s shift toward exploiting everyday business tools for initial compromise, making detection more difficult.
The operation also reportedly involved the deployment of Chaos ransomware as a decoy. By installing a secondary ransomware strain that left little evidence of the primary payload, MuddyWater aimed to mislead investigators and obscure the true source of the breach. This tactic complicates incident response, as security teams must sift through multiple malicious components to identify the real threat actor and the intended damage.
Cybersecurity experts emphasize the need for heightened scrutiny of Teams communications, especially when they contain unexpected attachments or links. Organizations are advised to verify the authenticity of any Teams message that requests sensitive actions and to ensure endpoint protection is tuned to detect ransomware signatures. The false‑flag nature of the attack also raises concerns about attribution, as MuddyWater may be attempting to divert blame to rival actors or to sow confusion among defenders.
Overall, the incident underscores the evolving threat landscape in which state‑backed groups leverage common collaboration tools and deceptive tactics to launch ransomware campaigns, demanding a more vigilant and layered security posture from enterprises worldwide.
Key changes
- MuddyWater used Microsoft Teams social engineering to initiate chats and harvest credentials.
- Credential theft occurred via phishing pages mimicking Microsoft Quick Assist or by tricking users into typing passwords into local files.
- Attackers manipulated MFA settings to bypass two‑factor authentication.
- Persistence was achieved through RDP, DWAgent, and AnyDesk remote‑access tools.
- A malware loader (ms_upd.exe) dropped a custom backdoor Game.exe disguised as Microsoft WebView2.
- Game.exe includes anti‑analysis and anti‑VM checks and supports 12 commands, including PowerShell, CMD, file upload/deletion, and persistent shell access.
- Rapid7 attributes the attack to MuddyWater based on shared infrastructure and a unique code‑signing certificate.
- The use of Chaos ransomware was a decoy to conceal espionage objectives.