Chaos ransomware

Researchers discovered an Iranian government-backed hacking group, MuddyWater, using Chaos ransomware as a cover for their attacks. The incident was initially thought to be a Chaos ransomware attack but was later attributed to MuddyWater, tied to Iran's Ministry of Intelligence and Security. This revelation highlights the evolving tactics of state-sponsored hacking groups.

MuddyWater Iranian hackers used Chaos ransomware as a decoy in their attacks, gaining access through Microsoft Teams social engineering and establishing persistence. The attackers relied on this tactic to disguise their operations. This approach allowed them to deceive targets about the true nature of the attack.