Executive summary
In early 2026, a sophisticated intrusion initially appearing to be a standard Chaos ransomware attack was assessed to be consistent with a targeted state-sponsored operation. While the threat actor operated under the banner of the Chaos ransomware-as-a-service (RaaS) group, forensic analysis revealed the incident was a "false flag" masquerade. Technical artifacts, including a specific code-signing certificate and Command-and-Control (C2) infrastructure, suggest with moderate confidence that this activity is linked to MuddyWater (Seedworm), an Iranian Advanced Persistent Threat (APT) affiliated with the Ministry of Intelligence and Security (MOIS).
The campaign was characterized by a high-touch social engineering phase conducted via Microsoft Teams, where the attackers utilized interactive screen-sharing to harvest credentials and manipulate Multi-Factor Authentication (MFA). Once inside, the group bypassed traditional ransomware workflows, forgoing file encryption in favor of data exfiltration and long-term persistence via remote management tools like DWAgent. This report deconstructs the infection chain and analyzes the custom "Game.exe" Remote Access Trojan (RAT).
Additionally, this explores the process by which MuddyWater is increasingly leveraging the cybercriminal ecosystem to provide plausible deniability for geopolitical espionage and prepositioning, particularly in the US. The strategy highlights the convergence between state-sponsored intrusion activity and criminal tradecraft, where a big “tell” lies in the techniques that were deployed – and those that weren’t.
This overall strategy suggests the primary goal was not financial gain. It is also further proof of the lines blurring against the background of geopolitical tensions, and that attribution is becoming more difficult if teams do not take it upon themselves to conduct proper and thorough research.
Rapid7 coverage
Rapid7 has coverage for this campaign across both intelligence and detection workflows. The campaign is available in Rapid7’s
.
Rapid7 Customers
Indicators of compromise (IoCs)
File indicators
File Name | SHA 256 | Description |
ms_upd.exe | 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14 | Initial Downloader ms_upd.exe |
DIDS.exe | a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0 | Initial Downloader found during hunt on public repositories |
Game.exe | 1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6 | RAT found during hunt on public repositories |
WebView2.exe | 3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90 | RAT |
visualwincomp.txt | c86ab27100f2a2939ac0d4a8af511f0a1a8116ba856100aae03bc2ad6cb0f1e0 | Encrypted config holding C2 url and port information |
WebView2Loader.dll | a47cd0dc12f0152d8f05b79e5c86bac9231f621db7b0e90a32f87b98b4e82f3a | DLL downloaded by ms_upd.exe |
dwagent.exe | cd098eddb23f2d2f6c42271ca82803b0d5ac950cb82a9b8ae0928e83945a53df | Remote Management Tool leveraged by the TA |
dwagent.exe | cf3dfd1d6626fd2129abb7a5983c11827f4b0d497e2dba146a1889bd71f23cd5 | Renamed pythonw.exe |
dwagsvc.exe | a3bac548b5bc91c526b4d6707623ddbd1a675aa952f0d1f9a0aa6f7230f09f23 | Service binary of DWService |
dwaglnc.exe | 86e0197389f0573eb83ff53991f337d416124c7c8bd727721ef3d396cd5f65d | Background and system tray binary of DWService |
AnyDesk.exe | bfc1675ee1e358db8356f515aaded7962923e426aa0a0a1c0eddfc4dab053f89 | Remote Management Tool leveraged by the TA |
⠀
Network indicators
Indicator | Description |
adm-pulse[.]com | Quick Assist themed phishing website |
moonzonet[.]com | URL hosting a second stage RAT Game.exe |
uploadfiler[.]com | C2 extracted from a config file visualwincomp.txt |
77.110.107[.]235 | Source IP address of malicious Microsoft Teams activity |
93.123.39[.]127 | Source IP address of malicious Microsoft Teams activity |
172.86.126[.]208 | C2 hosting initial downloader ms_upd.exe |
116.203.208[.]186 | IP contacted by renamed pythonw.exe |
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd[.]onion | Chaos RaaS DLS |
⠀
MITRE ATT&CK techniques
ATT&CK ID | Name | Use |
T1566 | Phishing (Spearphishing via Service) | Initial access via Microsoft Teams messages and social engineering |
T1059 | Command and Scripting Interpreter | Execution of discovery commands (ipconfig, whoami, etc.) |
T1082 | System Information Discovery | Gathering host-level information from compromised machines |
T1016 | System Network Configuration Discovery | Identifying network configuration via commands like ipconfig |
T1078 | Valid Accounts | Use of harvested credentials for authentication and access |
T1056 | Input Capture | Users entering credentials into attacker-directed files/pages |
T1556 | Modify Authentication Process | MFA manipulation to add attacker-controlled devices |
T1021.001 | Remote Services: RDP | Remote access to internal systems via RDP sessions |
T1219 | Remote Access Tools | Use of DWAgent and AnyDesk for persistence and control |
T1543 | Create or Modify System Process | Installation of DWAgent as a service |
T1055 | Process Injection / Proxy Execution | Abuse of renamed Python binary for execution |
T1105 | Ingress Tool Transfer | Downloading payloads via curl (ms_upd.exe) |
T1041 | Exfiltration Over C2 Channel | Data exfiltration to external infrastructure |
T1027 | Obfuscated/Encrypted Files or Information | Encrypted configuration (visualwincomp.txt) |
T1497 | Virtualization/Sandbox Evasion | Anti-VM checks in Game.exe |
T1622 | Debugger Evasion | Evasion techniques to avoid analysis |
T1071 | Application Layer Protocol | C2 communication over web protocols |
T1573 | Encrypted Channel | Encrypted communication with C2 infrastructure |
T1133 | External Remote Services | VPN access using compromised accounts |
T1087 | Account Discovery | Identifying user accounts via commands |
T1018 | Remote System Discovery | Enumerating systems in the network |
⠀
YARA rules
rule MuddyWaterRAT{
meta:
author = "Ivan Feigl [email protected]"
description = "Hunting rule for the RAT used by the MuddyWater, based on plain text string. Original sample MD5 F8560B9A893EEB2130FC7159E9C1B851"
strings:
//TKP - Token privilege
$TKP1 = "System"
$TKP2 = "Admin"
$TKP3 = "User"
// DF - Data format
$DF1 = "\"computer_name\":\""
$DF2 = "\"username\":\""
$DF3 = "\"domain\":\""
$DF4 = "\"local_ip\":\"127.0.0.1\""
$DF5 = "\"privilege\":\""
$DF6 = "\"process_name\":\"agent-"
$DF7 = "\"version\":\"E.1.0\""
$DF8 = "\"sleep_time\":60"
//IAT - Import address table
$IAT1 = "GetComputerNameA"
$IAT2 = "GetUserNameA"
$IAT3 = "NetWkstaGetInfo"
$IAT4 = "NetApiBufferFree"
$IAT5 = "AllocateAndInitializeSid"
$IAT6 = "OpenProcessToken"
$IAT7 = "GetTokenInformation"
$IAT8 = "EqualSid"
$IAT9 = "CheckTokenMembership"
//MSC - misc
$MSC1 = "re_register"
$MSC2 = "cmd_id"
$MSC3 = "cmd_id"
$MSC4 = "run_cmd"
$MSC5 = "cmd_line"
$MSC6 = "run_powershell"
condition:
uint16(0) == 0x5A4D and all of($TKP*) and all of($DF*) and all of($IAT*) and all of ($MSC*)
}
rule MuddyWaterDownloader{
meta:
author = "Ivan Feigl [email protected]"
description = "Hunting rule for the downloader used by the MuddyWater, based on plain text string. Original sample MD5 439C0A0A46627BD166E08436F383AD56"
strings:
//ST - Status
$ST1 = "downloading"
$ST2 = "running"
$ST3 = "success"
$ST4 = "error"
//SFF - Scanf formats
$SFF1 = "EXIT_%lu"
$SFF2 = "RUN_%lu"
$SFF3 = "DL_%s"
//ICO - Internet communication operation
$ICO1 = "/register" ascii wide
$ICO2 = "/check" ascii wide
$ICO3 = "/status" ascii wide
$ICO4 = "GET" ascii wide
$ICO5 = "POST" ascii wide
$ICO6 = "CONN_ERR" ascii wide
$ICO7 = "REQ_ERR" ascii wide
$ICO8 = "SEND_ERR" ascii wide
$ICO9 = "RECV_ERR" ascii wide
$ICO10 = "HTTP_%lu" ascii wide
//FO - File operation
$FO1 = "wb"
$FO2 = "EMPTY"
$FO3 = "FILE_ERR"
// DF - Data format
$DF1 = "\"client_id\":\"%s\""
$DF2 = "\"status\":\"%s\""
$DF3 = "\"error_code\":\"%s\""
//IAT - Import address table
$IAT1 = "GetLastError"
$IAT2 = "Sleep"
$IAT3 = "WinHttpOpen"
$IAT4 = "WinHttpConnect"
$IAT5 = "WinHttpOpenRequest"
$IAT6 = "WinHttpSendRequest"
$IAT7 = "WinHttpReceiveResponse"
$IAT8 = "WinHttpReadData"
$IAT9 = "WinHttpCloseHandle"
$IAT10 = "DeleteFileA"
condition:
uint16(0) == 0x5A4D and all of($ST*) and all of($SFF*) and all of($ICO*) and all of ($FO*) and all of ($DF*) and all of ($IAT*)
}
SOCIAL SHARE CARD GENERATOR