# STAC4749 Campaign: Microsoft Teams Vishing Leads to Chaos Ransomware Deployment

> Tracked by Sophos as STAC4749, a financially motivated actor cluster assessed to include former BlackSuit/Royal (Conti-lineage) ransomware members has run a Microsoft Teams vishing campaign since February 2026, impersonating IT helpdesk staff over voice calls from spoofed external accounts to gain remote access via Quick Assist, RemSupp, DWAgent and AnyDesk, then deploying Golang/Python backdoors and a reverse-SOCKS tunnel ahead of Chaos ransomware. At least three intrusions reached encryption, one in under 17 hours from initial contact.

- **Published:** 2026-07-30T00:00:00Z
- **Last reviewed:** 2026-07-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1776
- **ID:** TL-2026-1776
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** STAC4749
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between February and June 2026, Sophos X-Ops tracked a Microsoft Teams voice-phishing (vishing) campaign, designated STAC4749, that impersonated corporate IT helpdesk staff over external Teams calls to social-engineer employees into launching remote-access sessions. Operators used short, scripted calls (typically 2-2.5 minutes, ranging 90 seconds to 20+ minutes) from Teams accounts using invented personas (e.g. AnthonyBrooks, DylanHarper, EthanParker, JasonMitchell, and a dozen other randomized names) and referenced lookalike '.top'-TLD domains styled as internal IT/security portals (sequrityupdate[.]top, scan-security[.]top, system-online[.]top, system-connect[.]top, corp-connect[.]top, info-secure[.]top, supportsoft[.]top, update-syscontrol[.]top, and others) to add legitimacy.

Once a victim launched a remote-support session, operators initially relied on Microsoft Quick Assist (later phased out as it became blocklisted by defenders), before shifting primarily to the commercial cloud RMM tool RemSupp (remsupp.com) from April 2026 onward. DWAgent (dwservice.net) and AnyDesk (anydesk.com) were layered in for backup access and lateral movement, and RDP was enabled on compromised hosts via msconfig changes.

During the remote session, operators used PowerShell to pull first-stage loaders into %AppData%. Loader filenames rotated on a roughly two-to-four-week cadence to evade static detection: sekv_<10-digit>.exe (Feb-Mar), helper_<10-digit>.exe (Mar 26-Apr 9), and 74fs_<10-digit>.exe (Apr 10-13). These gRPC-speaking loaders hard-coded C2 IPs 94.140.114.192, 94.140.115.18 and 94.140.115.129 on port 443, performed host fingerprinting, generated a per-sample mutex, and checked for a dependency marker at C:\ProgramData\AppSreen\logs\appscreen.log before staging further payloads under AppData\Roaming. From mid-April, STAC4749 abandoned the standalone-loader step and pushed backdoors directly.

Persistence was established via HKCU Run keys disguised as audio-driver services -- 'Realtek HD Audio Universal Service', 'Realtek HD Audio', 'Realtek Audio', 'Realtek Audio UHD', and 'WinAudio life2' -- each pointing at the current-generation loader/backdoor binary, supplemented by VBS scripts (mklink-%.vbs) that dropped Startup-folder shortcuts disguised as SecurityHealth or OneDriveUpdate, with hidden file attributes applied selectively. Host discovery activity included computer-name/Machine-GUID collection, HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion enumeration, OS version queries, running-process enumeration, file/directory discovery, remote-system and domain-trust discovery, network-share discovery, and active security-product detection.

The primary C2 implant evolved along two tracks: a PyArmor-obfuscated, PyInstaller-packaged Python backdoor (updater.exe, 7414fs*.exe, 45234ssdf403851640.exe, msupdate.exe) that decrypted its AES-encrypted configuration using keys/IVs staged on a public GitHub repository and a workers[.]dev-hosted C2 channel; and a family of Golang implants named with single common nouns (dizzy.exe, graph.exe, tube.exe, confirm.exe, midnight.exe, shield.exe), deployed via a PowerShell one-liner pulling from attacker infrastructure (e.g. fa5[.]flsdwnld[.]online) and authenticating to C2 with a base64-encoded '--token-raw' argument, pinning connections to hard-coded CA certificate issuers (loop-CA, connectify-CA, james-bond-CA) so that mismatched issuers routed to segregated backend infrastructure. In incidents that escalated to ransomware, operators additionally deployed sc5.exe, a reverse SOCKS proxy supporting up to 1,000 concurrent connections, communicating with infrastructure at legio[.]name.

Data was staged and exfiltrated using a renamed/disguised GoodSync binary prior to encryption. Ransomware deployment used Chaos, a C++ ransomware-as-a-service family that re-emerged in February 2025 and which Cisco Talos and others assess with moderate confidence is operated by former BlackSuit (itself a Royal/Conti-lineage rebrand) members following the July 2025 Operation Checkmate seizure of BlackSuit infrastructure. Chaos combines ECDH (Curve25519) key agreement with AES-256 symmetric file encryption to derive a unique key per file, appends the '.chaos' extension, drops a 'readme.chaos.txt' ransom note that impersonates a security-testing engagement, deletes shadow copies via an obfuscated 'cmd.exe /c vssadmin delete shadows /all' invocation, includes anti-analysis routines (debugger/window enumeration, VM/sandbox pattern matching), and communicates over a reverse SSH tunnel (Windows OpenSSH client) to 45.61.134.36:443, with negotiation handled via victim-specific onion URLs and the contact address win88@thesecure[.]biz. Chaos practices double, triple (DDoS threats) and at times quadruple extortion (competitor/customer notification threats), operates a leak site with a distinctive 'blind' countdown timer that withholds the victim's identity until expiry, and has listed dozens of victims including neopharmlabs.com (July 22, 2026) and Craneware (July 28, 2026). At least three STAC4749 intrusions reached the Chaos encryption stage, with the fastest taking under 17 hours from initial Teams contact.

Attribution is financially motivated and assessed with low confidence toward Russian-speaking operators, based on a single hands-on-keyboard artifact -- a mistyped Cyrillic-keyboard command sequence ('вшк') apparently intended as 'dir'. Sophos found no supporting evidence for a competing Rapid7 hypothesis that Chaos is a false-flag operation run by the Iran-linked, state-sponsored MuddyWater (COBALT ULSTER) group, and treats that theory as unconfirmed.

Sophos has published detection signatures (SAAS-M365-Teams-SupportCall-Established-Suspicious-TLD; Troj/Backdr-PW; Troj/Backdr-PP; Troj/Agent-BMAK/BLZY/BLZD/BLXO/BLYG/BLYN; Troj/Chaos-Gen) and a full STAC4749-Chaos IOC set on GitHub (STAC4749-Chaos_IOCs_July2026.csv). Cisco Talos separately published Chaos-specific Snort (65125, 65126, 301273) and ClamAV (Win.Ransomware.Chaos-10045485-0) coverage.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1566.004 Spearphishing Voice
- T1133 External Remote Services
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1547.001 Registry Run Keys / Startup Folder
- T1547.009 Shortcut Modification
- T1547.001 Registry Run Keys / Startup Folder
- T1036.005 Match Legitimate Resource Name or Location
- T1036.004 Masquerade Task or Service
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1685 Disable or Modify Tools
- T1564.001 Hidden Files and Directories
- T1082 System Information Discovery
- T1012 Query Registry
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1518.001 Security Software Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1135 Network Share Discovery
- T1580 Cloud Infrastructure Discovery
- T1021.001 Remote Desktop Protocol
- T1021.004 SSH
- T1570 Lateral Tool Transfer
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1573.002 Asymmetric Cryptography
- T1219 Remote Access Tools
- T1132.001 Standard Encoding
- T1090.002 External Proxy
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Microsoft Teams vishing attacks lead to Chaos ransomware attacks](https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/)
- [Chaos in Teams vishing](https://www.sophos.com/en-us/blog/chaos-in-teams-vishing)
- [Unmasking the new Chaos RaaS group attacks](https://blog.talosintelligence.com/new-chaos-ransomware/)
- [Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware](https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/)
- [Chaos Ransomware: BlackSuit-Linked RaaS Resurgence and Detection Opportunities](https://securityboulevard.com/2026/07/chaos-ransomware-blacksuit-linked-raas-resurgence-and-detection-opportunities/)
- [Microsoft Teams Vishing Campaign Deploys Chaos Ransomware Through Fake IT Support Calls](https://cyberpress.org/teams-vishing-chaos-ransomware/?amp=1)
- [Microsoft Teams Vishing Attacks Linked to Chaos Ransomware](https://petri.com/microsoft-teams-vishing-chaos-ransomware/)
- [Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy Chaos Ransomware](https://gbhackers.com/it-helpdesk-on-microsoft-teams/)
- [A new vishing campaign is targeting Microsoft Teams - here's what users need to know](https://www.itpro.com/security/phishing/a-new-vishing-campaign-is-targeting-microsoft-teams-heres-what-users-need-to-know)
- [#StopRansomware: Royal Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a)
- [Rise of Chaos Ransomware Tied to BlackSuit Group's Exit](https://www.bankinfosecurity.com/rise-chaos-ransomware-tied-to-blacksuit-groups-exit-a-29067)
- [New Chaos ransomware group linked to BlackSuit amid site seizures](https://www.scworld.com/news/new-chaos-ransomware-group-linked-to-blacksuit-amid-site-seizures)
- [neopharmlabs.com Listed by chaos Ransomware Group](https://www.galaxywarden.com/blog/breach/neopharmlabs-com-chaos-2026-07)
- [thecranewaregroup.com Listed by chaos Ransomware Group](https://www.galaxywarden.com/blog/breach/thecranewaregroup-com-chaos-2026-07)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1776