Threat reportRansomwareTL-2026-1776

STAC4749 Campaign: Microsoft Teams Vishing Leads to Chaos Ransomware Deployment

highACTIVE

STAC4749 Campaign (TL-2026-1776), also tracked as Chaos in Teams Vishing, is a high-severity ransomware operation, first published 2026-07-30. It is attributed to STAC4749 with low confidence, affects Microsoft Microsoft Teams, maps to 39 MITRE ATT&CK techniques (T1012, T1016, T1018), and is covered by 9 detection rules and 32 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
0None referenced
Techniques
39MITRE ATT&CK
Actors
1STAC4749
Detection rules
9SPL · KQL · Sigma
IOCs
32Indicators of compromise

Key facts for TL-2026-1776

Threat ID
TL-2026-1776
Also known as
Chaos in Teams Vishing, Teams Vishing-to-Chaos Campaign
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
Last reviewed
Attribution
STAC4749
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
services, manufacturing, energy, construction, engineering, legal services, intellectual property law
Target regions
North America, canada, united states of america
Detection rules
9
Indicators of compromise
32

Malware and tooling in STAC4749 Campaign

Malware and tooling: Chaos ransomware, sc5.exe

How STAC4749 Campaign works

Tracked by Sophos as STAC4749, a financially motivated actor cluster assessed to include former BlackSuit/Royal (Conti-lineage) ransomware members has run a Microsoft Teams vishing campaign since February 2026, impersonating IT helpdesk staff over voice calls from spoofed external accounts to gain remote access via Quick Assist, RemSupp, DWAgent and AnyDesk, then deploying Golang/Python backdoors and a reverse-SOCKS tunnel ahead of Chaos ransomware. At least three intrusions reached encryption, one in under 17 hours from initial contact.

Between February and June 2026, Sophos X-Ops tracked a Microsoft Teams voice-phishing (vishing) campaign, designated STAC4749, that impersonated corporate IT helpdesk staff over external Teams calls to social-engineer employees into launching remote-access sessions. Operators used short, scripted calls (typically 2-2.5 minutes, ranging 90 seconds to 20+ minutes) from Teams accounts using invented personas (e.g. AnthonyBrooks, DylanHarper, EthanParker, JasonMitchell, and a dozen other randomized names) and referenced lookalike '.top'-TLD domains styled as internal IT/security portals (sequrityupdate[.]top, scan-security[.]top, system-online[.]top, system-connect[.]top, corp-connect[.]top, info-secure[.]top, supportsoft[.]top, update-syscontrol[.]top, and others) to add legitimacy.

Once a victim launched a remote-support session, operators initially relied on Microsoft Quick Assist (later phased out as it became blocklisted by defenders), before shifting primarily to the commercial cloud RMM tool RemSupp (remsupp.com) from April 2026 onward. DWAgent (dwservice.net) and AnyDesk (anydesk.com) were layered in for backup access and lateral movement, and RDP was enabled on compromised hosts via msconfig changes.

During the remote session, operators used PowerShell to pull first-stage loaders into %AppData%. Loader filenames rotated on a roughly two-to-four-week cadence to evade static detection: sekv_<10-digit>.exe (Feb-Mar), helper_<10-digit>.exe (Mar 26-Apr 9), and 74fs_<10-digit>.exe (Apr 10-13). These gRPC-speaking loaders hard-coded C2 IPs 94.140.114.192, 94.140.115.18 and 94.140.115.129 on port 443, performed host fingerprinting, generated a per-sample mutex, and checked for a dependency marker at C:\ProgramData\AppSreen\logs\appscreen.log before staging further payloads under AppData\Roaming. From mid-April, STAC4749 abandoned the standalone-loader step and pushed backdoors directly.

Persistence was established via HKCU Run keys disguised as audio-driver services -- 'Realtek HD Audio Universal Service', 'Realtek HD Audio', 'Realtek Audio', 'Realtek Audio UHD', and 'WinAudio life2' -- each pointing at the current-generation loader/backdoor binary, supplemented by VBS scripts (mklink-%.vbs) that dropped Startup-folder shortcuts disguised as SecurityHealth or OneDriveUpdate, with hidden file attributes applied selectively. Host discovery activity included computer-name/Machine-GUID collection, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion enumeration, OS version queries, running-process enumeration, file/directory discovery, remote-system and domain-trust discovery, network-share discovery, and active security-product detection.

The primary C2 implant evolved along two tracks: a PyArmor-obfuscated, PyInstaller-packaged Python backdoor (updater.exe, 7414fs*.exe, 45234ssdf403851640.exe, msupdate.exe) that decrypted its AES-encrypted configuration using keys/IVs staged on a public GitHub repository and a workers[.]dev-hosted C2 channel; and a family of Golang implants named with single common nouns (dizzy.exe, graph.exe, tube.exe, confirm.exe, midnight.exe, shield.exe), deployed via a PowerShell one-liner pulling from attacker infrastructure (e.g. fa5[.]flsdwnld[.]online) and authenticating to C2 with a base64-encoded '--token-raw' argument, pinning connections to hard-coded CA certificate issuers (loop-CA, connectify-CA, james-bond-CA) so that mismatched issuers routed to segregated backend infrastructure. In incidents that escalated to ransomware, operators additionally deployed sc5.exe, a reverse SOCKS proxy supporting up to 1,000 concurrent connections, communicating with infrastructure at legio[.]name.

Data was staged and exfiltrated using a renamed/disguised GoodSync binary prior to encryption. Ransomware deployment used Chaos, a C++ ransomware-as-a-service family that re-emerged in February 2025 and which Cisco Talos and others assess with moderate confidence is operated by former BlackSuit (itself a Royal/Conti-lineage rebrand) members following the July 2025 Operation Checkmate seizure of BlackSuit infrastructure. Chaos combines ECDH (Curve25519) key agreement with AES-256 symmetric file encryption to derive a unique key per file, appends the '.chaos' extension, drops a 'readme.chaos.txt' ransom note that impersonates a security-testing engagement, deletes shadow copies via an obfuscated 'cmd.exe /c vssadmin delete shadows /all' invocation, includes anti-analysis routines (debugger/window enumeration, VM/sandbox pattern matching), and communicates over a reverse SSH tunnel (Windows OpenSSH client) to 45.61.134.36:443, with negotiation handled via victim-specific onion URLs and the contact address win88@thesecure[.]biz. Chaos practices double, triple (DDoS threats) and at times quadruple extortion (competitor/customer notification threats), operates a leak site with a distinctive 'blind' countdown timer that withholds the victim's identity until expiry, and has listed dozens of victims including neopharmlabs.com (July 22, 2026) and Craneware (July 28, 2026). At least three STAC4749 intrusions reached the Chaos encryption stage, with the fastest taking under 17 hours from initial Teams contact.

Attribution is financially motivated and assessed with low confidence toward Russian-speaking operators, based on a single hands-on-keyboard artifact -- a mistyped Cyrillic-keyboard command sequence ('вшк') apparently intended as 'dir'. Sophos found no supporting evidence for a competing Rapid7 hypothesis that Chaos is a false-flag operation run by the Iran-linked, state-sponsored MuddyWater (COBALT ULSTER) group, and treats that theory as unconfirmed.

Sophos has published detection signatures (SAAS-M365-Teams-SupportCall-Established-Suspicious-TLD; Troj/Backdr-PW; Troj/Backdr-PP; Troj/Agent-BMAK/BLZY/BLZD/BLXO/BLYG/BLYN; Troj/Chaos-Gen) and a full STAC4749-Chaos IOC set on GitHub (STAC4749-Chaos_IOCs_July2026.csv). Cisco Talos separately published Chaos-specific Snort (65125, 65126, 301273) and ClamAV (Win.Ransomware.Chaos-10045485-0) coverage.

MITRE ATT&CK techniques used in TL-2026-1776

Discovery

T1012 Query Registry; T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery; T1580 Cloud Infrastructure Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 SSH; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1036.004 Masquerade Task or Service; T1036.005 Match Legitimate Resource Name or Location; T1497 Virtualization/Sandbox Evasion; T1564.001 Hidden Files and Directories

Execution

T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell

Command and Control

T1071.001 Web Protocols; T1090.002 External Proxy; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573.002 Asymmetric Cryptography

Initial Access

T1133 External Remote Services; T1566.004 Spearphishing Voice

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

Persistence

T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification

Privilege Escalation

T1547.001 Registry Run Keys / Startup Folder

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Resource Development

T1583.001 Domains; T1585.001 Social Media Accounts

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in STAC4749 Campaign

  • Microsoft — Microsoft Teams
    Vulnerable versions: Default configuration permitting external/anonymous inbound Teams calls and chats
    Fixed in: External access restricted/allow-listed per Teams admin-center hardening guidance
  • Microsoft — Quick Assist
    Vulnerable versions: Any version when unrestricted by application control policy
    Fixed in: N/A - legitimate remote-support tool; mitigated via blocklisting/application control, not a vendor patch
  • RemSupp — RemSupp cloud RMM client
    Vulnerable versions: Any version when installation is not restricted by endpoint application control
    Fixed in: N/A - abused as intended functionality

Remediation for STAC4749 Campaign

Patches

  • No CVE or software vulnerability is exploited in this campaign; STAC4749 abuses legitimate remote-support functionality and social engineering, so remediation is procedural/detection-based rather than patch-based

Immediate actions

  • Block or require security review of external Microsoft Teams messages/calls referencing unverified '.top'-TLD or lookalike IT-support domains (sequrityupdate[.]top, scan-security[.]top, system-online[.]top, system-connect[.]top, corp-connect[.]top, info-secure[.]top, supportsoft[.]top, update-syscontrol[.]top, and related variants)
  • Restrict or gate Microsoft Quick Assist, RemSupp, DWAgent and AnyDesk installation/execution behind application-control approval, especially when launched shortly after an inbound external Teams call
  • Hunt for and remove HKCU Run-key persistence disguised as 'Realtek HD Audio Universal Service', 'Realtek HD Audio', 'Realtek Audio', 'Realtek Audio UHD', or 'WinAudio life2'
  • Block outbound connections to known STAC4749/Chaos infrastructure: IPs 94.140.114.192, 94.140.115.18, 94.140.115.129, 45.61.134.36; domains legio[.]name, thesecure[.]biz, flsdwnld[.]online, and abuse of workers[.]dev subdomains for config retrieval
  • Isolate any host exhibiting reverse-SOCKS proxy activity (sc5.exe) or unexpected reverse-SSH/OpenSSH client traffic on port 443 immediately, and treat it as pre-ransomware staging

Workarounds

  • Disable Microsoft Quick Assist organization-wide where it is not operationally required and enforce blocklisting of RemSupp/DWAgent unless explicitly whitelisted for IT staff
  • Enforce mandatory security-awareness training on IT-helpdesk-impersonation vishing, emphasizing that legitimate IT staff will not cold-call over Teams to request remote-access sessions

Longer-term hardening

  • Enable Microsoft Teams external-access hardening (restrict or allow-list external domains/tenants permitted to call or message internal users) to blunt helpdesk-impersonation vishing
  • Deploy EDR behavioral detection for PowerShell-driven ingress tool transfer, unsigned remote-access-tool execution, and shadow-copy deletion via vssadmin/wmic
  • Require callback-verification (dial a pre-registered internal helpdesk number) before any employee grants a remote-support session initiated by an inbound call
  • Maintain immutable, offline, tested backups given Chaos's shadow-copy deletion and sub-24-hour encryption timelines
  • Import published detections: Sophos SAAS-M365-Teams-SupportCall-Established-Suspicious-TLD, Troj/Backdr-PW, Troj/Backdr-PP, Troj/Agent-BMAK, Troj/Agent-BLZY, Troj/Agent-BLZD, Troj/Agent-BLXO, Troj/Agent-BLYG, Troj/Agent-BLYN, Troj/Chaos-Gen; Cisco Talos Snort SIDs 65125/65126/301273 and ClamAV Win.Ransomware.Chaos-10045485-0

Timeline of STAC4749 Campaign

  • Chaos re-emerges as a Ransomware-as-a-Service operation with a redesigned C++ variant, advertised on the RAMP cybercrime forum.
  • Operation Checkmate seizes BlackSuit ransomware infrastructure; Cisco Talos later assesses with moderate confidence that some operators reformed as Chaos.
  • STAC4749 begins Microsoft Teams vishing operations impersonating IT helpdesk staff, initially relying on Microsoft Quick Assist for remote access.
  • STAC4749 deploys the sekv_<10-digit>.exe loader family (active through March 18), persisting via a 'Realtek HD Audio Universal Service' Run key.
  • Loader naming shifts to helper_<10-digit>.exe (active through April 9), with persistence renamed 'Realtek HD Audio'.
  • STAC4749 shifts its primary remote-access tool from Quick Assist to the cloud RMM RemSupp as Quick Assist becomes widely blocklisted.
  • Loader naming shifts again to 74fs_<10-digit>.exe (active through April 13).
  • Operators abandon standalone loaders mid-April, deploying the Python/Golang backdoors directly instead.
  • Persistence naming evolves to 'WinAudio life2' and 'Realtek Audio UHD'; STAC4749 experiments with DLL sideloading via the CopyQ binary.
  • Sophos's STAC4749 observation window closes; at least three tracked intrusions had escalated to Chaos ransomware deployment, the fastest in under 17 hours.
  • neopharmlabs.com appears on the Chaos data-leak site with a claimed 627GB archive and a 48-hour disclosure ultimatum.
  • Sophos publishes 'Chaos in Teams vishing', naming the STAC4749 cluster and releasing a full IOC set (STAC4749-Chaos_IOCs_July2026.csv) on GitHub.
  • UK health-tech company Craneware appears on the Chaos data-leak site with internal files exfiltrated during the attack.
  • BleepingComputer and other outlets publish coverage of the Sophos STAC4749 disclosure, prompting broader industry hunt guidance.

Sources cited for STAC4749 Campaign

Detection coverage for TL-2026-1776

As of 2026-07-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1776 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
32 indicators of compromise · Red and above. Compare plans

Community OSINT corroboration for TL-2026-1776

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats