Sophos is tracking a campaign, called STAC4749, in which attackers phone staff over Microsoft Teams
while posing as IT helpdesk, then talk them into granting remote access to their computer. Once in, the
attackers install custom malware and remote-control tools, spread across the network, and in several
cases deploy Chaos ransomware, once in under 17 hours from the first call. The campaign hit dozens
of organisations across the United States and Canada between February and June 2026.
1. Campaign Timeline
Between February and June 2026, STAC4749 operators targeted dozens of North American organisations, with roughly 95 per cent in Canada and the United States and a heavy focus on services, manufacturing, energy, and intellectual property law firms. Sophos links at least three of these intrusions to Chaos ransomware, a service run by former BlackSuit (Royal) operators. Rapid7 has suggested Chaos may be a MuddyWater false flag, but Sophos found no evidence tying STAC4749 to that group, and limited artefacts instead point to a Russian-language operator. Sophos assesses with high confidence that the operation was financially motivated.
2. Attack Details
Initial access
Operators contact staff through Microsoft Teams chats and calls while impersonating IT helpdesk, using plausible employee usernames on IT-themed .top domains rather than spoofed onmicrosoft[.]com tenants. Calls run from 90 seconds to more than 20 minutes.
Remote access
The caller persuades the user to start a remote session through Microsoft Quick Assist, falling back to the
RemSupp RMM tool, which operators increasingly prefer to dodge application blocklists. RDP is then enabled on the host through msconfig for lateral movement.
Payload staging
Through the remote session, operators run PowerShell to download malware into user-writable folders, most often AppData\Roaming. Early intrusions dropped a gRPC loader; from mid-April operators fetched the Python backdoor directly.
Persistence
The first-stage payload adds HKCU Run keys masquerading as Realtek or WinAudio audio components, and drops .vbs Startup shortcuts disguised as SecurityHealth or OneDriveUpdate, with hidden file attributes in some cases.
Command, control, and ransomware
The Python backdoor pulls Golang implants launched with a –token-raw argument, operators add DWAgent, AnyDesk, or a reverse SOCKS proxy, then deploy Chaos ransomware, encrypting endpoints near-simultaneously and dropping readme.chaos.txt notes.
3. Payload Capabilities
- gRPC loader The early first-stage loader profiled the host, generated per-sample mutexes, and beaconed over gRPC to three hard-coded IP addresses on port 443. It exited unless it found a specific product log file, a check that frustrated sandbox analysis.
- Python backdoor A PyArmor-obfuscated PyInstaller backdoor that runs shell commands, collects system data, and loads more Python modules. It pulled its AES key from a public GitHub repository, decrypted its configuration, reached out to workers[.]dev infrastructure, and staged stolen data in a base_library.zip archive.
- Golang implants Operators deployed one or more Go implants per environment, launched with a –token-raw token and signature to authenticate to C2. Several embedded CA certificates, loop-CA, connectify-CA, and james-bond-CA, and connected only to servers presenting a matching issuer, segmenting infrastructure by role.
- Reverse SOCKS proxy A standalone tunnelling tool, sc5.exe, opened outbound connections to legio[.]name and relayed traffic, supporting up to 1,000 concurrent connections and letting operators reach internal systems without a full backdoor.
4. Adversary Toolkit
| Tool / Indicator | Type | Function |
|---|---|---|
Python backdoor (updater.exe, msupdate.exe) | Python (PyInstaller) | PyArmor-obfuscated backdoor that executes shell commands, retrieves an AES key from GitHub, and stages data for exfiltration. |
| Golang implant | Go | Command-and-control (C2) implant launched with the --token-raw parameter. Uses pinned CA certificates to communicate with hardened, operator-controlled C2 servers. |
| sc5.exe | Reverse SOCKS proxy | Relays network traffic to legit[]name and supports up to 1,000 concurrent tunneled connections. |
| Quick Assist, RemSupp, DWAgent, AnyDesk | Legitimate remote access tools | Legitimate remote administration tools abused to provide interactive remote access and alternate control channels across the victim network. |
5. Indicators of Compromise (IOCs)
- https://www.virustotal.com/gui/collection/1bacc8aad786a9a9303564e6d959bd542541eed0a3a17c4d0b38b7ac8929796e/iocs
6. Recommendations
- Review Microsoft Teams for external chats and calls from IT-themed .top domains impersonating helpdesk staff, and check hosts for Quick Assist or RemSupp sessions started during those calls.
- Audit HKCU Run keys and Startup folder shortcuts for entries masquerading as Realtek, WinAudio, SecurityHealth, or OneDriveUpdate, and remove malicious loaders and backdoors from AppData\Roaming.
- Reset credentials on affected hosts and on any systems reached over RDP, since operators enable RDP through msconfig and move laterally after the initial remote session.
- Restrict Microsoft Quick Assist and unapproved RMM tools such as RemSupp, DWAgent, and AnyDesk through application control, and block their execution for standard users.
- Alert on PowerShell downloads into AppData and unexpected reverse-proxy or tunnelling traffic, and train staff to refuse unsolicited Teams support calls that request remote access.
- Block the IOCs at their respective controls, https://www.virustotal.com/gui/collection/1bacc8aad786 a9a9303564e6d959bd542541eed0a3a17c4d0b38b7ac8929796e/iocs
7. Sources
- https://www.sophos.com/en-us/blog/chaos-in-teams-vishing
- https://github.com/sophoslabs/IoCs/blob/master/STAC4749-Chaos_IOCs_July2026.csv
- https://blog.talosintelligence.com/new-chaos-ransomware/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.
