MuddyWater Microsoft Teams Credential Theft Campaign | MSSP Advisory

MuddyWater, an Iranian state-sponsored group, executed a false flag ransomware attack using Microsoft Teams as the initial attack vector through social engineering techniques. The attack was designed to appear as standard ransomware while serving intelligence gathering purposes. Rapid7 observed this campaign in early 2026 targeting credential theft operations.

Microsoft Teams sits in nearly every client environment you manage, and this attack vector bypasses traditional email security controls that most MSSPs have locked down. Your RMM and PSA platforms likely integrate with Teams or similar collaboration tools, creating a direct path into your management infrastructure if compromised. Clients expect you to know when nation-state actors are weaponizing their daily communication tools.

📬