Iranian State-Backed MuddyWater Poses as Ransomware Gang to Conceal Espionage (infosecurity-magazine.com)

• MuddyWater masqueraded as Chaos ransomware to hide espionage operations.
• Used extortion notes and leak site to feign financial motivation.
• Report advocates behavioral analysis over signature-based detection.

"An NCC Group report reveals that Iran-linked MuddyWater cyber espionage group posed as the Chaos ransomware gang. The actors used extortion notes, victim negotiation channels, and a listing on the Chaos leak site to appear as financially motivated criminals. This blurring of lines between state-backed and criminal activity complicates attribution. The report also notes other Iran-linked groups using criminal tools and collaborating with Russian cybercriminals."