SUBJECT PROFILE
Rapid7 disclosed in May 2026 that MuddyWater (Seedworm) conducted a sophisticated false-flag ransomware operation in early 2026, operating under the Chaos RaaS banner while forensic analysis revealed MOIS-linked code-signing certificates ('Donald Gay' + 'Amy Cherne' cert cluster) tying the intrusion to Operation Olalampo. The group used interactive Microsoft Teams sessions to harvest MFA credentials under an 'IT Support' social engineering persona. This marks a significant evolution: MuddyWater adopting a commercially available RaaS brand to project a cybercriminal identity while conducting intelligence-driven targeted operations, blurring the line between espionage and ransomware.
Espionage and pre-positioning for disruptive operations; use of ransomware as false flag to complicate attribution and obscure MOIS operational intent
OPERATIONAL HISTORY
Chaos RaaS false-flag deployment, MOIS code-signing certificate reuse ('Donald Gay'/'Amy Cherne' certs), Microsoft Teams interactive screen-sharing MFA harvesting, pythonw.exe process injection into suspended processes, triple/quadruple extortion threats (DDoS, customer notification), 'blind' countdown timer DLS technique to accelerate negotiation, social engineering IT support persona
KNOWN INFRASTRUCTURE
Chaos RaaS infrastructure (DLS with blind countdown timers); MOIS-linked code-signing certs cross-referenced in Operation Olalampo attribution; pythonw.exe injection chain; C2 consistent with prior MuddyWater MOIS infrastructure clusters