Threat Actor
STAC4749
- First Reported
- Jul 28, 2026
- Latest Reported
- Oct 26, 2026
Reported Context (3)
- The reported activity aligns with STAC4749, which has a history of creating IT-themed cloud domains under the .top TLD and using plausible employee usernames. Sophos reportedly linked attacks to deployment of Chaos ransomware. Microsoft Teams IT Support Scams Deliver Malware and, in Some Cases, Chaos Ransomware
- Sophos tracks the operators behind the reported Teams impersonation and remote-access campaign as STAC4749; at least three intrusions led to Chaos ransomware deployment. Sophos Details STAC4749 Teams Vishing Campaign Linked to Chaos Ransomware
- Sophos tracked this cluster conducting Teams vishing, deploying backdoors and remote-access tools, and in several intrusions deploying Chaos ransomware. Sophos Details STAC4749 Teams Vishing Campaign Leading to Chaos Ransomware
Malware (2)
Threat Actors (5)
MITRE ATT&CK (17)
Vendors (1)
Products (13)
Tools (5)
Industries (5)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.