Sophos Details STAC4749 Teams Vishing Campaign Linked to Chaos Ransomware
Summary
Sophos says STAC4749 targeted dozens of North American organizations through fake IT-support calls on Teams. Attackers used remote-access tools and backdoors; at least three intrusions led to Chaos ransomware, including one that reached encryption in under 17 hours.
Key points
- Sophos tracked STAC4749 activity against dozens of organizations from February to June 2026; about 95% of attacks targeted organizations in Canada and the United States.
- Attackers used external Microsoft Teams accounts and fake IT-support identities to persuade employees to start Quick Assist sessions or install remote-management tools.
- The actors shifted from Quick Assist toward RemSupp beginning in April, and used PowerShell to download a backdoor into users’ %AppData% folders.
- The backdoor profiled systems and maintained access; registry entries disguised as audio components were used for persistence.
- In some intrusions, attackers added DWAgent or AnyDesk for backup access and attempted to enable Remote Desktop Protocol for lateral movement.
- Sophos said at least three intrusions led to Chaos ransomware deployment; one reached file encryption in under 17 hours. Possible data theft was reported in at least one case, but is not established as fact.
- Sophos observed repeated changes to malware filenames, persistence mechanisms, and deployment methods. It found no evidence linking the campaign to MuddyWater.
Article Details
- Attack Vectors
- External Microsoft Teams accounts impersonated IT support in chats and voice calls to persuade employees to grant remote access.
- Attackers used Microsoft Quick Assist or the RemSupp remote management tool to access devices.
- PowerShell was used to download a backdoor into the compromised user's %AppData% folder.
- Malicious registry entries disguised as audio components were used for persistence.
- In incidents that led to ransomware, attackers used DWAgent or AnyDesk for backup access and attempted to enable Remote Desktop Protocol for lateral movement.
- Chaos ransomware encrypted files across compromised devices; at least one case likely involved data theft before deployment.
- Defensive Notes
- Review external Microsoft Teams chats and calls that claim to be IT support, especially requests to start remote support sessions.
- Monitor use of Quick Assist, RemSupp, DWAgent, AnyDesk, and PowerShell for unexpected remote access or downloads.
- Inspect registry persistence entries and audio-component names for suspicious or disguised changes.
- Monitor for attempts to enable Remote Desktop Protocol and for rapid progression from initial access to file encryption.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | corp-connect[.]top | IT-themed attacker domain used in the campaign's impersonation of support personnel. |
| DOMAIN | scan-security[.]top | IT-themed attacker domain used in the campaign's impersonation of support personnel. |
| DOMAIN | sequrityupdate[.]top | IT-themed attacker domain used in the campaign's impersonation of support personnel. |
| DOMAIN | supportsoft[.]top | IT-themed attacker domain used in the campaign's impersonation of support personnel. |
| DOMAIN | system-connect[.]top | IT-themed attacker domain used in the campaign's impersonation of support personnel. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolAttackers attempted to enable Remote Desktop Protocol on compromised devices for lateral movement.T1059.001 · PowerShellAttackers used PowerShell to download a backdoor into the compromised user's %AppData% folder.T1105 · Ingress Tool TransferThe attackers downloaded a backdoor to compromised devices.T1219 · Remote Access ToolsAttackers used Quick Assist, RemSupp, and, in ransomware incidents, DWAgent or AnyDesk for remote access.T1486 · Data Encrypted for ImpactChaos ransomware encrypted files across compromised devices.T1566.004 · Spearphishing VoiceSTAC4749 used Microsoft Teams voice calls to impersonate IT support and persuade employees to grant remote access.
Threat Actors
Black BastaBlack Basta affiliates were observed using unsolicited email and Microsoft Teams contact to impersonate corporate IT support in attacks described as prior examples, not as part of the STAC4749 campaign.BlacksuitSophos says Chaos is believed to be linked to former members of the BlackSuit ransomware gang; the article does not link BlackSuit directly to the STAC4749 campaign.ContiThe article describes BlackSuit and Royal as spinoffs from the Conti cybercrime syndicate; it does not link Conti directly to the STAC4749 campaign.MuddyWaterThe article says attacks attributed to MuddyWater allegedly used Chaos ransomware as a decoy; Sophos found no evidence connecting MuddyWater to the STAC4749 campaign.RoyalSophos says Chaos is believed to be linked to former members of the Royal ransomware gang; the article does not link Royal directly to the STAC4749 campaign.STAC4749Sophos tracks the operators behind the reported Teams impersonation and remote-access campaign as STAC4749; at least three intrusions led to Chaos ransomware deployment.
Malware
Products
Tools
AnyDeskIn incidents that later led to Chaos ransomware deployment, the attackers also installed remote access software such as DWAgent or AnyDesk for backup access to systems on the network.DWAgentIn incidents that later led to Chaos ransomware deployment, the attackers also installed remote access software such as DWAgent or AnyDesk for backup access to systems on the network.PowerShellAfter gaining remote access to employees’ devices, the attackers used PowerShell to ultimately download a backdoor into the compromised user’s %AppData% folder.Quick AssistThey used Quick Assist, RemSupp, and other tools to gain remote access and persist on devices.RemSuppThey used Quick Assist, RemSupp, and other tools to gain remote access and persist on devices.
Countries
Industries
Construction & EngineeringThe threat actors targeted organizations across numerous sectors, with services, manufacturing, energy, and construction and engineering experiencing the largest number of attacks.EnergyThe threat actors targeted organizations across numerous sectors, with services, manufacturing, energy, and construction and engineering experiencing the largest number of attacks.ManufacturingThe threat actors targeted organizations across numerous sectors, with services, manufacturing, energy, and construction and engineering experiencing the largest number of attacks.ServicesThe threat actors targeted organizations across numerous sectors, with services, manufacturing, energy, and construction and engineering experiencing the largest number of attacks.