Hackers Pose as IT Helpdesk on Microsoft Teams to Deploy Chaos Ransomware

Hackers are abusing Microsoft Teams voice calls and fake IT helpdesk personas to gain remote access to corporate endpoints, drop a custom post‑exploitation toolchain, and, in multiple cases rapidly pivot to Chaos ransomware deployment across North American organizations.

Nearly 95% of observed intrusions hit North American targets, with services, manufacturing, energy, construction and IP‑focused legal firms among the most affected sectors.

Once inside, operators prioritized speed, reliability and repeatability, regularly iterating their tooling and tradecraft to evade detection while moving toward data exfiltration and encryption.

STAC4749 sits on top of a broader surge in Microsoft Teams vishing abuse. Microsoft first detailed helpdesk‑style Teams and Quick Assist social engineering for the Black Basta ransomware in 2024, in activity attributed to Storm‑1811.

A financially motivated actor who used Teams messages and calls to impersonate support staff and walk victims into granting remote access via Quick Assist.

In late 2024 and early 2025, Sophos MDR documented similar IT‑themed Teams vishing playbooks in campaigns STAC5777 and STAC5143, including overlap with GOLD REBELLION, a threat group associated with Black Basta.

Chaos ransomware‑as‑a‑service (RaaS), first reported by Cisco Talos in early 2025 and assessed as linked to former BlackSuit (Royal) operators, built on these same themes: spam‑driven vishing, RMM abuse, rapid multi‑threaded encryption, and aggressive double‑extortion targeting U.S. and allied organizations.

In the STAC4749 campaign, initial access starts with unsolicited Teams chats and voice calls from accounts posing as helpdesk or “security update” staff.

Rather than relying on spoofed onmicrosoft[.]com tenants, the operators registered clusters of IT‑branded cloud domains under the “.top” TLD and bound them to plausible employee‑style usernames, including AnthonyBrooks, DylanHarper, EthanParker and others using domains like sequrityupdate[.]top.

These accounts were then used to launch short, scripted calls usually two to two‑and‑a‑half minutes designed to convince users to start a remote support session quickly.

Initially, STAC4749 leaned on Microsoft Quick Assist, mirroring Storm‑1811 and earlier Black Basta operations, with RemSupp deployed as a fallback RMM when Quick Assist was blocked.

From April onward, the actor appears to favor RemSupp outright, likely because it is less likely to appear on corporate blocklists and gives operators more reliable long‑term access.

Once on a host, they consistently attempted to enable RDP via msconfig service changes, setting the stage for lateral movement.

Sophos tracks this latest campaign as STAC4749, a financially motivated operation active between February and June 2026 and focused almost entirely on organizations in Canada and the United States.

Post‑exploitation activity in STAC4749 is driven by a modular, multi‑stage malware chain delivered through PowerShell from attacker‑controlled web infrastructure.

Early incidents used a dedicated loader staged in AppData\Roaming with filenames combining a static tag and randomized numeric suffix.

The loader performed system discovery, wrote mutexes and identifiers, checked for an AppScreen log file, and connected via gRPC to hard‑coded IPs in the 94[.]140[.]114[.]192/94[.]140[.]115[.]x range, then fetched a PyInstaller backdoor and additional payloads.

By mid‑April, the actors streamlined their toolchain, dropping the loader and delivering the Python‑based backdoor directly as the first stage.

This backdoor, obfuscated with PyArmour, can execute shell commands, collect extensive host metadata, dynamically load further Python modules and stage data in base_library.zip archives.

IT Helpdesk on Microsoft Teams

Configuration and AES keys are retrieved from a public GitHub repository, and C2 traffic is proxied through workers[.]dev, adding an additional layer of infrastructure obfuscation.

For C2 implants, STAC4749 relies on Golang binaries launched via PowerShell with a “–token‑raw” argument containing Base64‑encoded token and signature pairs used to authenticate to C2 and validate commands.

Filenames such as graph.exe, confirm.exe, midnight.exe and shield.exe vary per incident, but each implant establishes long‑lived encrypted connections and uses unique victim identifiers for per‑host management.

Notably, several implants embed certificate authority (CA) certificates and enforce certificate pinning, only connecting if the C2 server presents an issuer matching hard‑coded names like loop‑CA, connectify‑CA or james‑bond‑CA.

Payloads sharing an issuer talk to the same infrastructure, while different issuers map to different C2 clusters, suggesting deliberate segmentation by operational role and campaign.

Beyond the backdoor and primary implants, STAC4749 operators selectively deploy a custom tunneling tool, sc5.exe, implementing a reverse SOCKS proxy capable of supporting up to 1,000 concurrent connections and relaying traffic to infrastructure such as legio[.]name.

In environments destined for ransomware, they often layer in additional remote access tools including DWAgent and AnyDesk, mirroring TTPs previously associated with Chaos and 3AM ransomware campaigns that also abused Teams vishing and Quick Assist.

At least three intrusions investigated by Sophos culminated in Chaos ransomware deployment. In these cases, once lateral movement and possible exfiltration were complete, the actors triggered near‑simultaneous encryption across endpoints, appending the “.chaos” extension and dropping readme.chaos.txt ransom notes.

In one environment, the dwell time between initial Teams vishing call and full ransomware impact was under 17 hours consistent with Chaos RaaS playbooks emphasizing rapid selective encryption, double extortion, and pressure tactics.

Talos has previously assessed with moderate confidence that Chaos is operated by former BlackSuit members, while Sophos sees no evidence tying STAC4749 to Iranian‑linked MuddyWater, despite separate reporting of Chaos being used as a possible false flag in state‑sponsored operations.

For defenders, the campaign reinforces several points already highlighted by Microsoft and Sophos in prior Teams vishing and Quick Assist abuse reporting: enforce strict controls on external Teams communication, block or tightly manage remote support tools such as Quick Assist, RemSupp, AnyDesk and DWAgent.

IOCs

Name	Description
SAAS-M365-Teams-SupportCall-Established-Suspicious-TLD	Detection for suspicious Microsoft Teams chats
Troj/Backdr-PW	Detection for STAC4749 malicious DLL
Troj/Backdr-PP	Detection for STAC4749 backdoor
Troj/Agent-BMAK	Detection for STAC4749 Golang implants
Troj/Agent-BLZY	Detection for STAC4749 payloads
Troj/Agent-BLZD	Detection for STAC4749 reverse SOCKS proxy
Troj/Agent-BLXO	Detection for STAC4749 loader binaries

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide