Iran Dressed an Espionage Op as 'Chaos' Ransomware. We Were Already Watching the Domains.
- Patrick Duggan
- 16 hours ago
- 2 min read
Rapid7 published an intrusion this week that they attribute to MuddyWater, the unit affiliated with Iran's Ministry of Intelligence and Security, wearing a ransomware costume. The credit for the analysis is theirs, and it is good work. The entry point was social engineering over a Microsoft Teams screen share. From there: credential harvesting, MFA manipulation, and a quiet transition to operating through legitimate accounts. No file-encrypting ransomware ever dropped. It was an intelligence operation cosplaying as a smash-and-grab.
The costume is the point. A ransomware story gets routed to the insurance desk and a restore-from-backup runbook. An espionage story gets routed to people who ask much harder questions about what was read, copied, and left behind. Dressing a collection operation as Chaos ransomware buys the operator time and misdirects the response. This is the trust-lifecycle move we keep flagging: the attacker borrows the shape of a known, almost comfortable threat so the defender solves the wrong problem.
Here is the part the wire reports cannot say, and it is why we do this. We did not need the writeup to know MuddyWater was busy. They sit on our daily DNS surveillance list. We have been holding their CheckPoint-sourced exfiltration server, an rclone-to-Wasabi box at 18.223.24.218, since March. Our domain watchdog has been tracking a live rotation set in the same cluster: serialmenot dot com, moonzonet dot com, meetingapp dot site. Those were in our index before this week's report landed.
That is the asymmetric edge a billion-dollar vendor cannot sell you in a license. It is not the sentence "Iran did a thing." It is the sentence "here are the indicators we were already watching, with timestamps that predate the disclosure." A defender who pulled our feed in March had these markers months before the false flag was unmasked. We hunt the infrastructure, not the press cycle.
To be clear about where our line sits, capped at 95 percent confidence as always: we observe public infrastructure and cluster operators for defender intelligence. We do not run de-anonymization, we do not identify individuals, and we do not feed prosecutions. We watch the domains, we publish the receipts, and we let the people who own the perimeter decide what to do with a name they can now block.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.