# Fake IT Support via Microsoft Teams External Federation Leads to Remote Access and Malware (Chaos / Black Basta-linked)

> Attackers abuse default-enabled Microsoft Teams external chat federation to impersonate IT help desk staff, typically after email bombing, and talk victims into granting remote access via Quick Assist or other RMM tools. Arctic Wolf analyzed 400+ incidents; related clusters include Storm-1811/Black Basta and STAC4749, which deployed Chaos ransomware in under 17 hours in one case.

- **Published:** 2026-10-27T08:11:20Z
- **Last reviewed:** 2026-10-27T21:32:43.487Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4522
- **ID:** TL-2026-4522
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** STAC4749
- **Detections:** 9 · **IOCs:** 59 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Arctic Wolf Labs analyzed more than 400 incidents in which threat actors used Microsoft Teams external chat (federation, permitted by default in many tenants) to contact employees while posing as IT or help desk staff. The activity usually begins with email bombing: hundreds of newsletter and subscription confirmations arrive within minutes (Sophos observed 3,000 messages in 45 minutes in an earlier cluster), creating urgency and burying security alerts. The attacker then sends a Teams chat or call from an external tenant whose display name is made to look internal, for example with an '(Internal)' suffix or names such as 'Help Desk', 'IT Support' and 'Enterprise IT & Security (Internal)'. About 30-40% of attacker tenants used default *.onmicrosoft.com domains. Among paid domains roughly 50% were .top, about 40% .com and about 5% multi-level domains such as .com.pl, .com.vn and .com.br. Arctic Wolf also saw roughly 100 distinct emoji markers in attacker display names, and under 15 minutes from victim engagement to payload execution in reported chains.

Once the victim is engaged, the actor asks them to start a remote session. Quick Assist is the most frequently abused tool. AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn and Level were also observed. A PowerShell command then downloads an MSI from Azure Blob Storage. In a novel chain documented by Arctic Wolf, the MSI contains cleaner.ps1 (dropped under AppData\Local\PowershellCleaner\scripts) and archive6.zip. The script holds a hexadecimal array with an IEX instruction and an AES-encrypted block with hardcoded key and IV, validates a hash, and runs via ScriptBlock. It extracts a pythonw interpreter from archive6.zip and, after a 5-second sleep, runs the Python implant ss.py. The implant performs LDAP enumeration of Active Directory computer and user objects with System.DirectoryServices.DirectorySearcher, formats results as [sAMAccountName] - [description], and sends them to randomly selected C2 endpoints from a hardcoded domain/URI list.

Sophos tracked a related cluster, STAC4749, between February and June 2026. It targeted mainly North American organizations (about 50% Canada, 44% USA) via Teams vishing from IT-themed .top domains and personas, abusing Quick Assist, RemSupp, DWAgent and AnyDesk. Operators deployed a PyArmor-obfuscated PyInstaller backdoor, Golang implants, a reverse SOCKS tunneling tool (sc5.exe) and persistence registry entries masquerading as Realtek audio services, enabled RDP for lateral movement, and in several incidents deployed Chaos ransomware. In one incident, less than 17 hours passed between first Teams contact and ransomware deployment. Sophos assesses with high confidence that STAC4749 is financially motivated; the Sophos report notes suspected ties to former BlackSuit/Royal members. Earlier clusters (STAC5143, STAC5777) used the same Teams impersonation pattern and were tied to Black Basta deployment, with Sophos assessing with medium confidence that the Python malware in one attack connects to FIN7. Arctic Wolf also lists Storm-1811/Black Basta, Cactus, 3AM, GoGRPC and UNC6692 as related campaigns. The GBHackers article itself names no single actor, so attribution here is to multiple overlapping clusters with MEDIUM confidence.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.003 Cloud Accounts
- T1585.002 Email Accounts
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1199 Trusted Relationship
- T1667 Email Bombing
- T1684.001 Impersonation
- T1036 Masquerading
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.006 Python
- T1219 Remote Access Tools
- T1090 Proxy
- T1087.002 Domain Account
- T1547.001 Registry Run Keys / Startup Folder
- T1021.001 Remote Desktop Protocol
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1219.002 Remote Access Tools: Remote Desktop Software
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1656 Impersonation
- T1053.005 Scheduled Task/Job
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel

## Sources

- [Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections (GBHackers)](https://gbhackers.com/fake-it-support-scams/)
- [Threat Actors Abuse Microsoft Teams External Chat for Initial Access (Arctic Wolf)](https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/)
- [Chaos in Teams: STAC4749 vishing (Sophos)](https://www.sophos.com/en-gb/blog/chaos-in-teams-vishing)
- [Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ransomware-gangs-pose-as-it-support-in-microsoft-teams-phishing-attacks/)
- [Microsoft Teams vishing attacks lead to Chaos ransomware attacks (BleepingComputer)](https://bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks)
- [Hackers use Microsoft Teams for ransomware IT support scams (Cybersecurity Dive)](https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/)
- [Ransomware groups pose as fake tech support over Teams (CyberScoop)](https://cyberscoop.com/ransomware-groups-pose-as-fake-tech-support-over-teams/)
- [Free Tenants, Fake Help Desks (Black Hills InfoSec ActiveSOC)](https://activesoc.blackhillsinfosec.com/blog/free-tenants-fake-help-desks/)
- [Email bombing and fake IT support calls fuel Microsoft Teams phishing attacks (VPNCentral)](https://vpncentral.com/email-bombing-and-fake-it-support-calls-fuel-microsoft-teams-phishing-attacks/)
- [STAC4749 Uses Microsoft Teams Vishing to Deploy Chaos Ransomware in North America (Ampcus Cyber)](https://www.ampcuscyber.com/shadowopsintel/stac4749-uses-microsoft-teams-vishing-to-deploy-chaos-ransomware-in-north-america/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4522