Iran-sponsored threat group behind false flag social engineering campaign.

The article focuses on a months-long false-flag cyber operation by MuddyWater, a threat group linked to Iranian intelligence, targeting U.S. and international organizations under the guise of the Chaos ransomware-as-a-service (RaaS) group. Beginning in early 2026, MuddyWater used social engineering via Microsoft Teams to harvest credentials and bypass multifactor authentication, enabling persistent access through remote tools and custom malware. The operation aimed at strategically valuable targets, including government entities, and sought to obscure attribution by mimicking financially motivated ransomware attacks. Researchers note that despite the deceptive tactics, digital signatures link the attacks to Iran’s Ministry of Intelligence and Security, with additional targeting observed in the Middle East and South Asia. [Extracted from the article]