# MuddyWater (Seedworm) Iranian APT Masquerades as Chaos Ransomware — Microsoft Teams Social Engineering, DWAgent Persistence, Game.exe RAT Trojanizing Microsoft WebView2APISample (Operation Olalampo Link)

> Rapid7 disclosed a state-sponsored intrusion attributed with moderate confidence to MuddyWater (Seedworm), an Iranian MOIS-affiliated APT, that masqueraded as a Chaos ransomware-as-a-service attack. Initial access was obtained through Microsoft Teams 1:1 chats with interactive screen-sharing for credential harvesting and MFA manipulation, followed by AnyDesk/DWAgent persistence and a curl-fetched ms_upd.exe loader that delivered a custom RAT (Game.exe) trojanized from Microsoft's WebView2APISample. The 'Donald Gay' Microsoft-issued code-signing certificate ties the activity to MuddyWater's Operation Olalampo (March-April 2026); no file encryption was performed, indicating espionage and prepositioning rather than financial extortion.

- **Published:** 2026-05-06T12:00:00Z
- **Last reviewed:** 2026-05-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0468
- **ID:** TL-2026-0468
- **Severity:** HIGH
- **Category:** APT
- **Status:** MONITORING
- **Actor:** MuddyWater (Iran)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-05-06 Rapid7's Threat Research team published 'Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware', documenting a multi-stage intrusion that publicly presented as a Chaos ransomware-as-a-service (RaaS) operation but was technically and organizationally linked with moderate confidence to MuddyWater (Seedworm), an Iranian APT linked to the Ministry of Intelligence and Security (MOIS). The activity overlaps with MuddyWater's broader 2026 Operation Olalampo targeting United States and MENA organizations across construction, manufacturing, and business services verticals.

Initial access was obtained through interactive Microsoft Teams 1:1 chats originated from an attacker-controlled Teams account impersonating an internal IT support persona that MuddyWater has refined throughout 2026. The actor invoked Teams screen-sharing to walk targets through a Quick Assist-themed phishing page hosted at hxxps://adm-pulse[.]com/verify.php, instructing victims to type credentials into local text files (credentials.txt, cred.txt) and to add attacker-controlled devices to their MFA configuration. The Teams sessions originated from 77.110.107.235 and 93.123.39.127.

Once credentials and MFA were compromised, the operator established hands-on-keyboard footholds via RDP and deployed two legitimate remote-access tools — AnyDesk (bfc1675ee1e358db8356f515aaded7962923e426aa0a0a1c0eddfc4dab053f89) and DWAgent (dwagent.exe / dwagsvc.exe / dwaglnc.exe) — to provide redundant persistence channels resilient to credential resets. A renamed pythonw.exe (cf3dfd1d6626fd2129abb7a5983c11827f4b0d497e2dba146a1889bd71f23cd5) shipped with the DWAgent bundle was used for in-memory code injection and beaconed to 116.203.208.186.

From the foothold, the actor used curl to download ms_upd.exe (24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14) from 172.86.126.208. The downloader uses a /register, /check, /status registration flow against moonzonet[.]com, then fetches three secondary components — Game.exe (1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6) renamed from a benign Microsoft WebView2 binary, a side-loaded WebView2Loader.dll (a47cd0dc12f0152d8f05b79e5c86bac9231f621db7b0e90a32f87b98b4e82f3a), and visualwincomp.txt (c86ab27100f2a2939ac0d4a8af511f0a1a8116ba856100aae03bc2ad6cb0f1e0), an AES-256-GCM encrypted configuration containing the C2 hostname uploadfiler[.]com and port. After staging, ms_upd.exe self-deletes via the well-worn 'cmd.exe /c ping 127.0.0.1 -n 6 > nul && del' technique.

Game.exe is a custom RAT trojanized from Microsoft's open-source WebView2APISample project (PDB path: C:\Users\pc\Downloads\WebView2Samples-main\...\Release\x64\WebView2APISample.pdb). It establishes persistence in C:\ProgramData\visualwincomp-<random>\, enforces single-instance execution via the ATTRIBUTES_ObjectKernel mutex, polls /index.php on its C2 every 60 seconds, and exposes 12 core operator commands (run_cmd, run_powershell, upload, upload_chunk, delete_file, cmd_start, cmd_input, cmd_stop, ps_start, ps_input, ps_stop, re_register). Anti-analysis covers dynamic API/DLL resolution (T1027.007), sandbox detection (sbiedll.dll, dbghelp.dll, api_log.dll, vmcheck.dll, wpespy.dll), VM-string checks (Virtual, VMWare, KVM, Hyper-V) using XOR key 0xAB, removable-drive enumeration, and time-based sleep skews (T1497.003). Rapid7 notes inconsistent tradecraft — XOR-encoded VM strings beside plaintext file paths and command opcodes, and dynamic Sleep() resolution despite static imports — characterizing the developer as 'unseasoned' relative to mature MuddyWater tooling.

Attribution rests primarily on the 'Donald Gay' code-signing certificate (issuer: Microsoft ID Verified CS AOC CA 02; thumbprint: B674578D4BDB24CD58BF2DC884EAA658B7AA250C; algorithm: sha384RSA; serial: 33 00 07 9A 51 C7 06 3E 66 05 3D 22 9B 00 00 00 07 9A 51), a Microsoft-issued Authenticode certificate previously documented as a shared MuddyWater resource paired with the 'Amy Cherne' identity and used to sign Stagecomp (the ms_upd.exe family) and Darkcomp (the Game.exe family) backdoors throughout Operation Olalampo (March-April 2026). The certificate was time-revoked shortly after this deployment. Secondary attribution evidence includes infrastructure overlap with MuddyWater (moonzonet[.]com surfaced in early-2026 MuddyWater telemetry), pythonw.exe injection tradecraft consistent with prior MuddyWater intrusions, and the IT-support Teams social-engineering persona refined by MuddyWater across 2026 (which echoes the 2025 Qilin RaaS-fronted operation later attributed to MOIS).

No file encryption or destructive payload was executed. The actor sent extortion email referencing a Chaos data leak site at hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd[.]onion to maintain the ransomware cover story, but the operational tempo, persistence-heavy tooling, and absence of mass encryption indicate espionage and long-term prepositioning consistent with MOIS objectives. Defenders are advised to treat any apparent Chaos RaaS event involving Microsoft Teams social engineering, AnyDesk/DWAgent installation, WebView2-themed binaries in C:\ProgramData\visualwincomp-*, or Microsoft-signed binaries bearing the Donald Gay or Amy Cherne signers as a high-priority MuddyWater investigation rather than a commodity ransomware incident.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1204 User Execution
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1497.003 Time Based Checks
- T1622 Debugger Evasion
- T1070 Indicator Removal
- T1553 Subvert Trust Controls
- T1556 Modify Authentication Process
- T1036 Masquerading
- T1055 Process Injection
- T1056 Input Capture
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1120 Peripheral Device Discovery
- T1021.001 Remote Desktop Protocol
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1219 Remote Access Tools
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware](https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/)
- [Microsoft Edge WebView2APISample (legitimate project trojanized by Game.exe)](https://github.com/MicrosoftEdge/WebView2Samples/tree/main/SampleApps/WebView2APISample)
- [MITRE ATT&CK Group G0069 — MuddyWater](https://attack.mitre.org/groups/G0069/)
- [CISA Alert AA22-055A — Iranian Government-Sponsored MuddyWater Cyber Actors](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a)
- [Microsoft Threat Intelligence — Mango Sandstorm (MuddyWater) Profile](https://learn.microsoft.com/en-us/defender-xdr/microsoft-threat-actor-naming)
- [Microsoft — Trusted Signing / Microsoft ID Verified CS AOC CA Code Signing](https://learn.microsoft.com/en-us/azure/trusted-signing/concept-trusted-signing-trust-models)
- [Rapid7 Iran Conflict Cyber Threat Intelligence Hub](https://www.rapid7.com/)
- [DWService Project — DWAgent Remote Management Tool](https://www.dwservice.net/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0468