Iranian APT group MuddyWater used Chaos ransomware as cover

The cybercriminals used this smokescreen to conduct a cyberespionage operation and steal strategic data.

Cybersecurity company Rapid7 published a report on May 6, 2026, about a cyberattack apparently carried out by the Chaos ransomware gang, but ultimately attributed to the Iranian APT group MuddyWater. Researchers provided no details about the victim of the operation. However, they established that MuddyWater, a group linked to Iran’s Ministry of Intelligence and Security (MOIS), had conducted the attack for cyberespionage purposes and to steal strategic data.

According to Alexandra Blia and Ivan Feigl, cybersecurity researchers at Rapid7, the use of Chaos “reflects a continued effort to conceal the objectives of operations and complicate attribution.” “MuddyWater’s increased activity since the beginning of 2026, particularly in cyberespionage and in preparing disruptive actions against Western and Middle Eastern networks, has likely led to greater use of false-flag operations,” the two experts added.

Active since February 2025, Chaos is believed to be an offshoot of the now-defunct BlackSuit and Royal groups. In 2025, researchers had already established links between MuddyWater and the Russian-speaking ransomware gang Qilin, in an attack against an Israeli company.