Full Report
Threat actors are impersonating IT support staff in Microsoft Teams calls to gain remote access to corporate devices and deploy Chaos ransomware in attacks targeting North American organizations. [...]
Analysis Summary
# Incident Report: STAC4749 Microsoft Teams Vishing Campaign
## Executive Summary
A financially motivated threat actor, tracked as STAC4749, targeted North American organizations by impersonating IT support staff through Microsoft Teams voice calls and chats. The attackers coerced employees into granting remote access via Quick Assist or RemSupp, ultimately deploying Chaos ransomware. The campaign was characterized by a rapid attack lifecycle, with some intrusions moving from initial contact to full-disk encryption in less than 17 hours.
## Incident Details
- **Discovery Date:** February 2026 (Campaign onset)
- **Incident Date:** February – June 2026
- **Affected Organization:** Dozens of organizations (names undisclosed)
- **Sector:** Services, Manufacturing, Energy, Construction, and Engineering
- **Geography:** North America (50% Canada, 45% USA)
## Timeline of Events
### Initial Access
- **Date/Time:** Variable (February through June 2026)
- **Vector:** Vishing (Voice Phishing) and Social Engineering via Microsoft Teams.
- **Details:** Attackers used external Teams accounts and IT-themed domains (e.g., `.top` TLDs) to call employees. Calls lasted between 90 seconds and 20 minutes, convincing users to launch remote support tools.
### Lateral Movement
- **Details:** After gaining a foothold, attackers attempted to enable Remote Desktop Protocol (RDP) on compromised devices. They also installed secondary remote access software (AnyDesk, DWAgent) to maintain redundant access across the network.
### Data Exfiltration/Impact
- **Details:** In at least one case, data was stolen prior to encryption. Chaos ransomware was deployed simultaneously across compromised devices to maximize disruption.
### Detection & Response
- **Discovery:** Sophos tracked the campaign (STAC4749) identifying shifts in tactics between February and May.
- **Response:** Analysts identified a short 17-hour "speed-to-ransom" window, suggesting highly coordinated or automated deployment procedures.
## Attack Methodology
- **Initial Access:** Vishing via Microsoft Teams; use of IT-themed aliases (e.g., "Jason Mitchell").
- **Persistence:** Malicious registry entries disguised as "Realtek HD Audio" or "WinAudio life2" in `%AppData%`.
- **Privilege Escalation:** Not explicitly detailed, but implied through the use of administrative tools like Quick Assist.
- **Defense Evasion:** Use of legitimate RMM tools (RemSupp, AnyDesk) to bypass application blocklists; frequent rotation of malware filenames.
- **Credential Access:** Potential harvesting during remote sessions or via backdoor profiling.
- **Discovery:** System profiling via PowerShell backdoor.
- **Lateral Movement:** Enabling RDP; installation of DWAgent/AnyDesk.
- **Collection:** Gathering files for exfiltration prior to encryption.
- **Exfiltration:** Theft of corporate data (confirmed in at least one instance).
- **Impact:** Encryption of files using Chaos Ransomware; deployment of `readme.chaos.txt`.
## Impact Assessment
- **Financial:** High (Ransom demands; potential data recovery costs).
- **Data Breach:** Confirmed theft of sensitive corporate data.
- **Operational:** Severe disruption; simultaneous encryption of multiple network devices.
- **Reputational:** Public disclosure of data if ransom is unpaid.
## Indicators of Compromise
- **Network Indicators:**
- sequrityupdate[.]top
- scan-security[.]top
- system-connect[.]top
- corp-connect[.]top
- supportsoft[.]top
- **File Indicators:** `readme.chaos.txt`
- **Behavioral Indicators:** Unexpected external Microsoft Teams calls; unauthorized execution of Microsoft Quick Assist; new registry keys for "WinAudio life2" or "Realtek HD Audio" in user profiles.
## Response Actions
- **Containment:** Blocking known malicious `.top` domains at the DNS/Firewall level.
- **Eradication:** Removal of unauthorized RMM tools (RemSupp, AnyDesk, DWAgent) and deletion of malicious registry persistence keys.
- **Recovery:** Restoration of files from offline backups following Chaos ransomware encryption.
## Lessons Learned
- **Vulnerability of Teams:** External communication settings in Microsoft Teams are being exploited as a direct line to employees, bypassing email filters.
- **Speed of Attack:** The 17-hour window from access to encryption highlights the need for 24/7 monitoring and rapid automated response.
- **RMM Abuse:** Attackers are successfully pivoting from native tools (Quick Assist) to third-party RMMs (RemSupp) when blocked.
## Recommendations
- **Teams Configuration:** Restrict Microsoft Teams to only allow communication with "Trusted Domains" or disable external access if not required.
- **Application Control:** Implement strict allow-listing for remote management tools; block or alert on the execution of Quick Assist and AnyDesk for non-IT staff.
- **User Training:** Conduct specific vishing simulations targeting Microsoft Teams and "IT Support" impersonation.
- **Endpoint Monitoring:** Monitor for unusual PowerShell activity in `%AppData%` and unexpected registry modifications to audio-related components.