MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

The Iranian state-sponsored hacking group MuddyWater, also known as Mango Sandstorm, Seedworm, and Static Kitten, has been linked to a ransomware attack conducted as a false flag operation. Security researchers at Rapid7 identified the attack in early 2026, which used social engineering tactics through Microsoft Teams to initiate the infection sequence.