Sophos Details STAC4749 Teams Vishing Campaign Leading to Chaos Ransomware

Jul 28, 2026 · Original article ↗

Summary

Sophos tracked STAC4749, a Teams-vishing campaign targeting dozens of North American organizations from February to June 2026. Operators used remote-access tools and evolving backdoors; at least three intrusions led to Chaos ransomware.

Key points

Operators impersonated IT support through Teams chats and calls, using IT-themed .top domains and employee-like personas to persuade targets to grant remote access.
About 95% of observed targets were in Canada or the United States; affected organizations spanned multiple sectors.
The attackers used Quick Assist and later increasingly favored RemSupp, then ran PowerShell payloads that included custom loaders, a Python-based backdoor, and Go-based implants.
Persistence included disguised Windows Run keys and hidden Startup-folder shortcuts; attackers also used tools such as DWAgent and AnyDesk for alternate remote access.
Sophos found implants using pinned certificates to restrict command-and-control connections, with different certificate issuers associated with separate infrastructure.
At least three intrusions led to Chaos ransomware deployment; in one, encryption followed initial access in under 17 hours. Data exfiltration was considered likely in at least one incident.
Sophos found insufficient evidence to attribute STAC4749 to MuddyWater or another actor. Recommended defenses include monitoring suspicious Teams contacts, remote-access tool use, PowerShell, and registry persistence.

Article Details

Attack Vectors: Operators impersonated helpdesk or IT support through Microsoft Teams chats and voice calls to persuade users to grant remote access.
After gaining a remote session, operators used Quick Assist or deployed RemSupp, then launched PowerShell to retrieve and execute payloads from attacker-controlled servers.
Operators attempted to enable RDP on initial hosts for lateral movement and used additional remote-access tools in some intrusions.
Payloads established persistence through registry Run keys and, in some cases, disguised Startup-folder shortcuts.
At least three intrusions culminated in Chaos ransomware deployment after access was expanded across multiple systems; data exfiltration was considered likely in at least one incident.
Defensive Notes: Monitor Microsoft Teams for suspicious external chats and calls, especially requests to launch remote-support tools, download software, or grant system access.
Use endpoint detection and response to identify abnormal PowerShell and command-line activity and unauthorized remote-administration or tunneling tools.
Regularly audit registry Run keys and other persistence locations for entries disguised as legitimate services or applications.
Train employees to recognize suspicious external messages, calls, and remote-access requests.
Enforce application controls and restrict unauthorized software execution.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`corp-connect[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`info-secure[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`it-service[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`legio[.]name`	Attacker infrastructure contacted by the STAC4749 reverse SOCKS proxy.
DOMAIN	`scan-security[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`scansequrity[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`sequpdate[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`sequritycheck[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`sequrityupdate[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`service-clien[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`service-corporation[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`service-help[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`supportsoft[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`system-connect[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`system-online[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`update-syscontrol[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`upsecscan[.]top`	IT-support-themed domain associated with STAC4749 vishing attempts.
DOMAIN	`workers[.]dev`	Attacker infrastructure hosting communications for a decrypted STAC4749 payload.
IPV4	`193[.]29[.]57[.]37`	C2 server used by multiple STAC4749 payloads.
IPV4	`94[.]140[.]114[.]192`	Hard-coded STAC4749 loader C2 address; the article specifies port 443.
IPV4	`94[.]140[.]115[.]129`	Hard-coded STAC4749 loader C2 address; the article specifies port 443.
IPV4	`94[.]140[.]115[.]18`	Hard-coded STAC4749 loader C2 address; the article specifies port 443.
URL	`hxxps[:]//fa5[.]flsdwnld[.]online/f5yxog/confirm.exe`	Attacker-controlled URL used in the article's PowerShell example to download a STAC4749 implant.