MuddyWater (Seedworm) Iranian APT Masquerades as Chaos Ransomware — Microsoft Teams Social Engineering, DWAgent Persistence, Game.exe RAT Trojanizing Microsoft WebView2APISample (Operation Olalampo Link)

MuddyWater (Seedworm) Iranian APT Masquerades as Chaos (TL-2026-0468), also tracked as Operation Olalampo, is a high-severity advanced persistent threat campaign, first published 2026-05-06. It is attributed to MuddyWater (Iran) with medium confidence, affects Microsoft Microsoft Teams, maps to 31 MITRE ATT&CK techniques (T1016, T1018, T1021.001), and is covered by 9 detection rules and 33 indicators of compromise.

Key facts for TL-2026-0468

Threat ID
TL-2026-0468
Also known as
Operation Olalampo, Chaos Ransomware Masquerade, Stagecomp/Darkcomp Campaign 2026
Severity
HIGH
Status
MONITORING
Category
APT
First published
2026-05-06
Last reviewed
2026-05-06
Attribution
MuddyWater
Attribution confidence
MEDIUM
Nation-state nexus
Iran
Motivation
ESPIONAGE
Target sectors
construction, manufacturing, business services, government, energy, telecommunications
Target regions
United States, Middle East, North Africa, MENA
Detection rules
9
Indicators of compromise
33

Malware and tooling in MuddyWater (Seedworm) Iranian APT Masquerades as Chaos

Malware and tooling: Darkcomp, Stagecomp, AnyDesk, DWAgent (DWService), Stagecomp + Darkcomp (custom MuddyWater toolkit)

Rapid7 disclosed a state-sponsored intrusion attributed with moderate confidence to MuddyWater (Seedworm), an Iranian MOIS-affiliated APT, that masqueraded as a Chaos ransomware-as-a-service attack. Initial access was obtained through Microsoft Teams 1:1 chats with interactive screen-sharing for credential harvesting and MFA manipulation, followed by AnyDesk/DWAgent persistence and a curl-fetched ms_upd.exe loader that delivered a custom RAT (Game.exe) trojanized from Microsoft's WebView2APISample. The 'Donald Gay' Microsoft-issued code-signing certificate ties the activity to MuddyWater's Operation Olalampo (March-April 2026); no file encryption was performed, indicating espionage and prepositioning rather than financial extortion.

How MuddyWater (Seedworm) Iranian APT Masquerades as Chaos works

On 2026-05-06 Rapid7's Threat Research team published 'Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware', documenting a multi-stage intrusion that publicly presented as a Chaos ransomware-as-a-service (RaaS) operation but was technically and organizationally linked with moderate confidence to MuddyWater (Seedworm), an Iranian APT linked to the Ministry of Intelligence and Security (MOIS). The activity overlaps with MuddyWater's broader 2026 Operation Olalampo targeting United States and MENA organizations across construction, manufacturing, and business services verticals.

Initial access was obtained through interactive Microsoft Teams 1:1 chats originated from an attacker-controlled Teams account impersonating an internal IT support persona that MuddyWater has refined throughout 2026. The actor invoked Teams screen-sharing to walk targets through a Quick Assist-themed phishing page hosted at hxxps://adm-pulse[.]com/verify.php, instructing victims to type credentials into local text files (credentials.txt, cred.txt) and to add attacker-controlled devices to their MFA configuration. The Teams sessions originated from 77.110.107.235 and 93.123.39.127.

Once credentials and MFA were compromised, the operator established hands-on-keyboard footholds via RDP and deployed two legitimate remote-access tools — AnyDesk (bfc1675ee1e358db8356f515aaded7962923e426aa0a0a1c0eddfc4dab053f89) and DWAgent (dwagent.exe / dwagsvc.exe / dwaglnc.exe) — to provide redundant persistence channels resilient to credential resets. A renamed pythonw.exe (cf3dfd1d6626fd2129abb7a5983c11827f4b0d497e2dba146a1889bd71f23cd5) shipped with the DWAgent bundle was used for in-memory code injection and beaconed to 116.203.208.186.

From the foothold, the actor used curl to download ms_upd.exe (24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14) from 172.86.126.208. The downloader uses a /register, /check, /status registration flow against moonzonet[.]com, then fetches three secondary components — Game.exe (1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6) renamed from a benign Microsoft WebView2 binary, a side-loaded WebView2Loader.dll (a47cd0dc12f0152d8f05b79e5c86bac9231f621db7b0e90a32f87b98b4e82f3a), and visualwincomp.txt (c86ab27100f2a2939ac0d4a8af511f0a1a8116ba856100aae03bc2ad6cb0f1e0), an AES-256-GCM encrypted configuration containing the C2 hostname uploadfiler[.]com and port. After staging, ms_upd.exe self-deletes via the well-worn 'cmd.exe /c ping 127.0.0.1 -n 6 > nul && del' technique.

Game.exe is a custom RAT trojanized from Microsoft's open-source WebView2APISample project (PDB path: C:\Users\pc\Downloads\WebView2Samples-main\...\Release\x64\WebView2APISample.pdb). It establishes persistence in C:\ProgramData\visualwincomp-<random>\, enforces single-instance execution via the ATTRIBUTES_ObjectKernel mutex, polls /index.php on its C2 every 60 seconds, and exposes 12 core operator commands (run_cmd, run_powershell, upload, upload_chunk, delete_file, cmd_start, cmd_input, cmd_stop, ps_start, ps_input, ps_stop, re_register). Anti-analysis covers dynamic API/DLL resolution (T1027.007), sandbox detection (sbiedll.dll, dbghelp.dll, api_log.dll, vmcheck.dll, wpespy.dll), VM-string checks (Virtual, VMWare, KVM, Hyper-V) using XOR key 0xAB, removable-drive enumeration, and time-based sleep skews (T1497.003). Rapid7 notes inconsistent tradecraft — XOR-encoded VM strings beside plaintext file paths and command opcodes, and dynamic Sleep() resolution despite static imports — characterizing the developer as 'unseasoned' relative to mature MuddyWater tooling.

Attribution rests primarily on the 'Donald Gay' code-signing certificate (issuer: Microsoft ID Verified CS AOC CA 02; thumbprint: B674578D4BDB24CD58BF2DC884EAA658B7AA250C; algorithm: sha384RSA; serial: 33 00 07 9A 51 C7 06 3E 66 05 3D 22 9B 00 00 00 07 9A 51), a Microsoft-issued Authenticode certificate previously documented as a shared MuddyWater resource paired with the 'Amy Cherne' identity and used to sign Stagecomp (the ms_upd.exe family) and Darkcomp (the Game.exe family) backdoors throughout Operation Olalampo (March-April 2026). The certificate was time-revoked shortly after this deployment. Secondary attribution evidence includes infrastructure overlap with MuddyWater (moonzonet[.]com surfaced in early-2026 MuddyWater telemetry), pythonw.exe injection tradecraft consistent with prior MuddyWater intrusions, and the IT-support Teams social-engineering persona refined by MuddyWater across 2026 (which echoes the 2025 Qilin RaaS-fronted operation later attributed to MOIS).

No file encryption or destructive payload was executed. The actor sent extortion email referencing a Chaos data leak site at hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd[.]onion to maintain the ransomware cover story, but the operational tempo, persistence-heavy tooling, and absence of mass encryption indicate espionage and long-term prepositioning consistent with MOIS objectives. Defenders are advised to treat any apparent Chaos RaaS event involving Microsoft Teams social engineering, AnyDesk/DWAgent installation, WebView2-themed binaries in C:\ProgramData\visualwincomp-*, or Microsoft-signed binaries bearing the Donald Gay or Amy Cherne signers as a high-priority MuddyWater investigation rather than a commodity ransomware incident.

MITRE ATT&CK techniques used in TL-2026-0468

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1120 Peripheral Device Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1070 Indicator Removal; T1497 Virtualization/Sandbox Evasion; T1497.003 Time Based Checks; T1622 Debugger Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056 Input Capture; T1552 Unsecured Credentials

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1573 Encrypted Channel

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing

Persistence

T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

defense-impairment

T1553 Subvert Trust Controls; T1556 Modify Authentication Process

Impact

T1657 Financial Theft

Affected products and versions in MuddyWater (Seedworm) Iranian APT Masquerades as Chaos

  • Microsoft — Microsoft Teams
    Vulnerable versions: All tenants permitting external 1:1 chat federation
    Fixed in: No patch — configuration hardening required
  • Microsoft — Authenticode Code Signing (Microsoft ID Verified CS AOC CA 02)
    Vulnerable versions: Donald Gay signer thumbprint B674578D4BDB24CD58BF2DC884EAA658B7AA250C; Amy Cherne signer (paired identity)
    Fixed in: Signers revoked; install latest Microsoft trust-list update
  • philandro Software GmbH — AnyDesk
    Vulnerable versions: Any version when installed by unauthorized user
    Fixed in: Block via AppLocker/WDAC; not a vulnerability
  • DWService — DWAgent
    Vulnerable versions: Any version when installed by unauthorized user
    Fixed in: Block via AppLocker/WDAC; not a vulnerability

Remediation for MuddyWater (Seedworm) Iranian APT Masquerades as Chaos

Patches

  • No CVE patches apply; this is a tradecraft and identity-compromise threat. Apply Microsoft Defender threat-intelligence indicator updates released after 2026-05-06 that cover MuddyWater Stagecomp/Darkcomp signatures.

Immediate actions

  • Block C2 domains moonzonet.com, uploadfiler.com, adm-pulse.com at perimeter DNS, web proxy, and EDR network filters
  • Block IP addresses 172.86.126.208, 116.203.208.186, 77.110.107.235, 93.123.39.127 at firewall and EDR
  • Hunt for the 11 SHA-256 hashes in this report across EDR telemetry, Authenticode-signed binary inventories, and cloud sandbox submissions
  • Block Authenticode signers 'Donald Gay' and 'Amy Cherne' (Microsoft ID Verified CS AOC CA 02) via Microsoft Defender for Endpoint indicators or AppLocker publisher rules
  • Treat any Microsoft Teams 1:1 chat from external tenants requesting screen-sharing for IT support as a phishing event; collect Teams audit logs and quarantine the user
  • Force password reset and revoke all session tokens, OAuth refresh tokens, and registered MFA devices for any user who accepted an external Teams chat in the last 60 days
  • Hunt C:\ProgramData\visualwincomp-* directories and the ATTRIBUTES_ObjectKernel mutex on all endpoints
  • Hunt for credentials.txt and cred.txt files in user profile directories and quarantine for forensic review

Workarounds

  • Restrict external Microsoft Teams federation tenant-wide until threat-hunting confirms no inbound MuddyWater contact attempts
  • Disable interactive screen-sharing in Microsoft Teams for unmanaged or external users
  • Place AnyDesk and DWAgent binaries on Defender Attack Surface Reduction blocklists if not used operationally

Longer-term hardening

  • Disable external Microsoft Teams federation by default; allowlist only required partner tenants and require admin approval for new external chats
  • Block installation and execution of unauthorized RMM tools (AnyDesk, DWAgent, ScreenConnect, Atera, Splashtop, etc.) via AppLocker, WDAC, or Microsoft Defender Application Control
  • Enforce phishing-resistant MFA (FIDO2 or hardware tokens) for all privileged and externally accessible accounts; remove SMS and push-only methods
  • Deploy alerting on additions to the user's MFA factor list and geographic anomalies during Teams sessions
  • Block outbound curl, wget, and certutil downloads to non-corporate destinations from user workstations via EDR network rules
  • Adopt code-signing certificate transparency monitoring (e.g., crt.sh, Microsoft trust list) and integrate Authenticode-signer reputation into EDR detections
  • Train help-desk and end-users on Quick Assist and Microsoft Teams impersonation tactics with quarterly tabletop exercises

Timeline of MuddyWater (Seedworm) Iranian APT Masquerades as Chaos

  • Operation Olalampo first observed by threat-intel reporting; MuddyWater begins large-scale targeting of US and MENA organizations using shared 'Donald Gay' and 'Amy Cherne' Microsoft-issued code-signing certificates.
  • 'Donald Gay' Authenticode certificate (thumbprint B674578D4BDB24CD58BF2DC884EAA658B7AA250C, issuer Microsoft ID Verified CS AOC CA 02) observed signing Stagecomp (ms_upd.exe) and Darkcomp (Game.exe) backdoor families.
  • Attacker-controlled Microsoft Teams account opens 1:1 chat with target users posing as IT support; sessions originate from 77.110.107.235 and 93.123.39.127 and use interactive screen-sharing to direct victims to hxxps://adm-pulse[.]com/verify.php (Quick Assist-themed phishing page).
  • Victims are coached to type credentials into local credentials.txt/cred.txt files and to add attacker-controlled devices to MFA, providing the actor with persistent authenticated access.
  • Operator establishes hands-on-keyboard footholds via RDP and installs AnyDesk and DWAgent (dwagent.exe, dwagsvc.exe, dwaglnc.exe) for redundant remote access; renamed pythonw.exe component beacons to 116.203.208.186.
  • Operator uses curl to fetch ms_upd.exe (SHA-256 24857fe8...e4d14) from 172.86.126.208; loader registers with C2 moonzonet[.]com via /register, /check, /status endpoints.
  • ms_upd.exe pulls Game.exe (SHA-256 1319d474...f97b6, trojanized WebView2APISample), WebView2Loader.dll, and AES-256-GCM encrypted visualwincomp.txt config; persistence directory C:\ProgramData\visualwincomp-<random>\ created. ms_upd.exe self-deletes via 'cmd /c ping 127.0.0.1 -n 6 > nul && del'.
  • Game.exe RAT polls uploadfiler[.]com/index.php every 60 seconds, exposing 12 operator commands (run_cmd, run_powershell, upload, upload_chunk, delete_file, cmd_start/input/stop, ps_start/input/stop, re_register); ATTRIBUTES_ObjectKernel mutex set.
  • Actor sends Chaos-themed extortion email referencing data leak site hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd[.]onion; no file encryption or destructive payload executed, indicating false-flag intent.
  • Microsoft revokes the 'Donald Gay' code-signing certificate after Rapid7 disclosure preparation; certificate flagged time-invalid in subsequent Authenticode chain checks.
  • Rapid7 publishes 'Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware', attributing the activity with moderate confidence to MuddyWater (Seedworm) / Iranian MOIS and tying it to Operation Olalampo.
  • As of 2026-05-29, this MuddyWater (Seedworm/MOIS) Operation Olalampo false-flag campaign remains a live concern: the actor is highly active across 2026 (Dindoor, RustyWater implants) with no disruption or arrests. The named IOCs are published and the Donald Gay signing cert was revoked 2026-05-04, but the Teams-social-engineering/RMM/WebView2-RAT tradecraft persists, so it sits in MONITORING rather than ACTIVE.

Sources cited for MuddyWater (Seedworm) Iranian APT Masquerades as Chaos

Threats related to MuddyWater (Seedworm) Iranian APT Masquerades as Chaos

Detection coverage for TL-2026-0468

As of 2026-05-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0468 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats