Rapid7 Assesses Chaos-Branded Intrusion as Likely MuddyWater False Flag

May 14, 2026 · Original article ↗

Summary

Rapid7 says a Chaos-branded intrusion likely linked to MuddyWater used Microsoft Teams social engineering to steal credentials and establish remote access, then exfiltrated data without encrypting files. Its analysis details the downloader and custom RAT.

Key points

Rapid7 assessed the intrusion as a likely false-flag operation linked to MuddyWater with moderate confidence, citing a code-signing certificate, infrastructure overlap, and tradecraft.
Attackers used external Microsoft Teams chats and screen-sharing to harvest credentials and manipulate MFA, then accessed internal systems with compromised accounts.
The operators used RDP, DWAgent, and AnyDesk for persistent access and exfiltrated data; Rapid7 found no file encryption in the investigated intrusion.
The ms_upd.exe downloader fetched Game.exe, a custom RAT disguised as a Microsoft WebView2 application.
Game.exe decrypts its configuration with AES-256-GCM, polls its C2 every 60 seconds, and supports command execution, file operations, and interactive shells.
The RAT includes sandbox and virtual-machine checks; Rapid7 also identified C2 infrastructure including moonzonet[.]com as attribution evidence.
Rapid7 and the victim found no artifacts matching the attackers’ initial claim of a ransom note, but the victim confirmed that data later published on the Chaos leak site was legitimate.

Article Details

Attack Vectors: The operators initiated external Microsoft Teams chats from a controlled account and used interactive screen-sharing to access users' systems.
Victims were directed to enter credentials into locally created text files; in at least one instance, they accessed a Quick Assist-themed phishing page, and the operators instructed users to add attacker-controlled devices to MFA.
Compromised accounts were used to access internal systems, including a Domain Controller, and to establish RDP sessions for lateral movement.
DWAgent and AnyDesk were used for remote access and persistence. The operators used curl to download ms_upd.exe, which delivered the Game.exe RAT and an encrypted configuration file.
The intrusion involved data exfiltration and extortion claims; the report says the victim later confirmed that data published on the Chaos leak site was legitimate.
Defensive Notes: Investigate the underlying intrusion lifecycle rather than relying on ransomware indicators alone; the report describes Chaos branding without file encryption.
Monitor for suspicious external Teams chats and screen-sharing, credential collection, and changes that add attacker-controlled MFA devices.
Review compromised-account use, RDP activity, and deployment of DWAgent or AnyDesk for unauthorized remote access.
The report notes that Game.exe exposed plaintext strings and other telemetry that AV and EDR solutions were able to use to identify and stop the threat.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`moonzonet[.]com`	C2 domain contacted by ms_upd.exe for registration and status checks.
DOMAIN	`uploadfiler[.]com`	C2 hostname extracted from Game.exe's encrypted configuration.
IPV4	`116[.]203[.]208[.]186`	IP address contacted by the renamed pythonw.exe during the intrusion.
IPV4	`172[.]86[.]126[.]208`	Host identified as serving the initial ms_upd.exe downloader.
IPV4	`77[.]110[.]107[.]235`	Source IP address associated in the report with malicious Microsoft Teams activity.
MD5	`439c0a0a46627bd166e08436f383ad56`	Original sample MD5 identified in the YARA rule for the downloader.
MD5	`f8560b9a893eeb2130fc7159e9c1b851`	Original sample MD5 identified in the YARA rule for the RAT.
SHA1	`b674578d4bdb24cd58bf2dc884eaa658b7aa250c`	Code-signing certificate thumbprint associated by the report with the malware chain and its moderate-confidence MuddyWater attribution.
SHA256	`1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6`	SHA-256 of Game.exe, identified as the RAT delivered by ms_upd.exe.
SHA256	`24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14`	SHA-256 listed for the initial ms_upd.exe downloader.
SHA256	`3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90`	SHA-256 of a Game.exe-like RAT sample found during a public malware-sharing-platform hunt.
SHA256	`86e0197389f0573eb83ff53991f337d416124c7c8bd727721ef3d396cd5f65dc`	SHA-256 listed for a DWService background and system-tray binary used in the intrusion.
SHA256	`a3bac548b5bc91c526b4d6707623ddbd1a675aa952f0d1f9a0aa6f7230f09f23`	SHA-256 listed for a DWService service binary used in the intrusion.
SHA256	`a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0`	SHA-256 listed for a downloader sample found during a public-repository hunt.
SHA256	`bfc1675ee1e358db8356f515aaded7962923e426aa0a0a1c0eddfc4dab053f89`	SHA-256 listed alongside AnyDesk.exe, which the report says was used to facilitate remote access.
SHA256	`c86ab27100f2a2939ac0d4a8af511f0a1a8116ba856100aae03bc2ad6cb0f1e0`	SHA-256 of visualwincomp.txt, the encrypted configuration file downloaded with Game.exe.
SHA256	`cd098eddb23f2d2f6c42271ca82803b0d5ac950cb82a9b8ae0928e83945a53df`	SHA-256 listed for a remote management tool leveraged during the intrusion.
SHA256	`cf3dfd1d6626fd2129abb7a5983c11827f4b0d497e2dba146a1889bd71f23cd5`	SHA-256 listed for the renamed pythonw.exe used in the intrusion.
URL	`hxxp[:]//172[.]86[.]126[.]208:443/ms_upd.exe`	Payload-download URL used to retrieve the ms_upd.exe downloader.
URL	`hxxps[:]//adm-pulse[.]com/verify.php`	Quick Assist-themed phishing page identified in browser artifacts and used for credential harvesting.