Listen to this Post
Introduction: When the Help Desk Call Becomes the Attack Vector
The modern workplace has become more connected than ever, but that same connectivity has created new opportunities for cybercriminals. Instead of breaking through sophisticated firewalls or exploiting complex software vulnerabilities, attackers are increasingly choosing a simpler path: convincing employees to open the door themselves.
A newly discovered campaign tracked as STAC4749 shows how threat actors are abusing trust in workplace communication platforms. By impersonating corporate IT support staff through Microsoft Teams calls, attackers trick employees into installing remote access tools, gaining control of company devices, and eventually deploying Chaos ransomware.
The campaign, investigated by Sophos, highlights a dangerous evolution in ransomware operations. Cybercriminals are no longer relying only on malicious files or exposed servers. They are using social engineering, fake identities, and legitimate remote management software to bypass traditional defenses.
Between February and June 2026, dozens of organizations across North America were targeted. Some victims experienced a full ransomware attack in less than 17 hours after the first fraudulent Teams interaction, demonstrating how quickly a seemingly harmless support conversation can transform into a major security incident.
The Rise of Fake IT Support Attacks Through Microsoft Teams
A New Generation of Social Engineering
For years, attackers have used phishing emails to compromise businesses. However, security teams have improved email filtering, employee awareness training, and endpoint protection. As a result, cybercriminals have shifted toward more personal approaches.
Microsoft Teams has become an attractive target because employees naturally trust internal communication platforms. A message from someone claiming to be “IT Support” feels more legitimate than a random email from an unknown sender.
The STAC4749 campaign demonstrates this shift. Instead of sending traditional phishing messages, attackers directly contacted employees through Teams chats and voice calls while pretending to provide technical assistance.
Their objective was simple:
Convince employees that their device had a problem.
Offer technical help.
Gain permission to access the computer remotely.
Install malware while appearing legitimate.
This approach exploits human trust rather than technical weaknesses.
How the STAC4749 Campaign Operated
Fake Support Agents and Fraudulent Domains
According to Sophos researchers, attackers created external Microsoft Teams accounts designed to look like legitimate IT professionals.
The attackers used names such as:
Anthony Brooks
Dylan Harper
Ethan Parker
Jason Mitchell
To strengthen the illusion, they registered IT-related domains using the .top top-level domain.
Examples included:
sequrityupdate[.]top
scan-security[.]top
system-connect[.]top
corp-connect[.]top
supportsoft[.]top
The use of these domains was carefully designed to create familiarity. Employees seeing names and domains related to security or support services were more likely to believe the communication was genuine.
The Attack Begins With a Microsoft Teams Call
Social Engineering Before Malware Deployment
The first stage of the attack relied entirely on persuasion.
Sophos researchers observed Teams calls lasting from approximately 90 seconds to more than 20 minutes. Most conversations lasted around two to three minutes, suggesting attackers had developed a highly optimized script.
The fake support representatives attempted to convince employees to install remote assistance software.
The main tools used included:
Microsoft Quick Assist
RemSupp remote management software
Quick Assist was initially the preferred option because it is a legitimate Microsoft utility. However, attackers later moved toward RemSupp because it was less likely to be blocked by corporate security controls.
This demonstrates a common attacker strategy: abuse trusted tools instead of creating suspicious malware from the beginning.
From Remote Access to Full System Compromise
PowerShell Becomes the Gateway
After obtaining remote access, attackers moved quickly.
They used PowerShell commands to download a backdoor into the compromised user’s:
%AppData%
directory.
The malware then performed several actions:
System reconnaissance
User and device profiling
Persistence creation
Remote attacker communication
The attackers also attempted to remain hidden by disguising malicious registry entries as legitimate audio and hardware components.
Examples included:
Realtek HD Audio
Realtek Audio UHD
WinAudio life2
These names were chosen because many users and administrators would assume they belonged to normal Windows or hardware processes.
Deep Analysis: How the STAC4749 Attack Chain Works
Understanding the Technical Infection Process
The STAC4749 campaign represents a complete ransomware intrusion lifecycle built around identity manipulation and remote access abuse.
A simplified attack flow looks like this:
Victim Employee
|
|
Fake Microsoft Teams IT Support Contact
|
|
Social Engineering Conversation
|
|
Remote Access Approval
|
|
Quick Assist / RemSupp Installation
|
|
PowerShell Execution
|
|
Backdoor Deployment
|
|
Persistence Creation
|
|
Credential Discovery
|
|
Lateral Movement
|
|
Chaos Ransomware Deployment
PowerShell Investigation Commands
Security teams can investigate suspicious PowerShell activity using:
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
Suspicious processes can be reviewed with:
Get-Process | Sort CPU -Descending
Registry persistence locations should be checked:
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Network connections can be inspected using:
netstat -ano
Organizations should monitor unusual execution paths such as:
%AppData%
%Temp%
%ProgramData%
because attackers frequently use these directories for malware storage.
Attackers Added Backup Access Before Ransomware Deployment
Preparing the Environment for Extortion
In cases that resulted in ransomware, attackers did not rely on a single access method.
They installed additional remote access software including:
DWAgent
AnyDesk
These tools provided backup access if the original malware was discovered or removed.
The attackers also attempted to enable Remote Desktop Protocol (RDP) to move laterally across networks.
Typical lateral movement objectives include:
File servers
Domain controllers
Backup systems
Critical business applications
Once attackers reach enough systems, ransomware deployment becomes much more damaging.
Chaos Ransomware Enters the Operation
A Fast Transition From Access to Encryption
At least three organizations affected by STAC4749 experienced Chaos ransomware deployment.
In one confirmed incident, attackers moved from the first Teams contact to encryption in less than 17 hours.
The ransomware created ransom notes named:
readme.chaos.txt
The messages claimed that attackers had stolen company data and threatened public leaks if payment demands were ignored.
This follows the modern ransomware model:
Steal sensitive information.
Encrypt company files.
Demand payment.
Threaten public exposure.
This double-extortion strategy has become standard among ransomware groups.
The Connection Between Chaos and Previous Ransomware Groups
A New Name With an Old History
Sophos researchers believe Chaos ransomware has operated since at least February 2025.
The group is believed to have connections with former members of:
BlackSuit ransomware
Royal ransomware
Conti cybercrime operations
The Conti ecosystem has historically influenced many ransomware groups. Even after major gangs disappear, their members, tools, and techniques often continue through new organizations.
The STAC4749 campaign shows that ransomware operations are becoming more flexible, combining social engineering, legitimate software abuse, and automated encryption.
Microsoft Teams Becomes a Growing Target for Cybercriminals
Why Attackers Prefer Collaboration Platforms
Microsoft Teams, Slack, Zoom, and similar platforms are attractive because they exist inside normal business workflows.
Employees expect:
Messages from colleagues.
Technical support requests.
Remote assistance sessions.
Attackers exploit this expectation.
Previous campaigns have shown similar tactics. For example, ransomware groups have used Teams messages after flooding employee inboxes with spam emails to create confusion and urgency.
The difference today is that attackers are becoming more professional. They create fake identities, websites, and support procedures that resemble real corporate environments.
How Organizations Can Defend Against Teams-Based Attacks
Security Recommendations for Businesses
Organizations should consider implementing:
Restrict External Teams Communication
Disable unnecessary external communication:
Set-CsExternalAccessPolicy
Limit who can contact employees from outside organizations.
Control Remote Assistance Tools
Review and restrict:
Quick Assist
AnyDesk
DWAgent
Remote Management Software
Remote access tools should require approval and logging.
Monitor Suspicious PowerShell Activity
Enable:
PowerShell logging
Script block monitoring
Endpoint detection alerts
Train Employees Against IT Impersonation
Employees should remember:
Real IT teams rarely request:
Installing unknown software.
Sharing credentials.
Disabling security tools.
Granting unrestricted remote access.
What Undercode Say:
Cybersecurity Is Moving From Exploiting Machines to Exploiting Humans
The STAC4749 campaign represents a major shift in ransomware tactics.
Attackers discovered that the strongest security systems can still fail when employees trust the wrong person.
Traditional cybersecurity focused heavily on vulnerabilities, patches, and malware signatures. Those defenses remain important, but modern attackers increasingly target human decision-making.
Microsoft Teams was designed to improve communication, collaboration, and productivity. Unfortunately, the same trust that makes it valuable also makes it attractive to criminals.
The attackers behind STAC4749 did not need an advanced zero-day exploit.
They needed:
A convincing identity.
A believable story.
A few minutes of employee attention.
This campaign demonstrates that cybersecurity is becoming a psychological battle.
Ransomware groups are adopting techniques similar to professional fraud organizations.
They research targets.
They create fake brands.
They build convincing online identities.
They use legitimate software.
They avoid traditional malware detection.
The use of Quick Assist is especially concerning because it highlights a growing problem: trusted applications can become weapons.
Security teams cannot simply block every legitimate tool because employees need these technologies for daily operations.
The challenge is creating balance between productivity and protection.
Organizations should begin treating collaboration platforms as security-critical infrastructure.
Microsoft Teams should not be viewed only as a communication application.
It is now part of the attack surface.
Identity verification must become stronger.
External communication policies must become stricter.
Employees must be trained that “IT support” is not automatically trustworthy.
Artificial intelligence may also increase the danger of these campaigns.
Future attackers could use AI-generated voices, realistic employee profiles, and automated conversations to make fake support calls almost impossible to distinguish from legitimate interactions.
The next generation of ransomware may not begin with a malicious attachment.
It may begin with a friendly conversation.
The cybersecurity industry must prepare for attacks where deception becomes the primary weapon.
✅ Confirmed: Microsoft Teams Is Being Used in Social Engineering Campaigns
Sophos documented the STAC4749 campaign involving fake IT support identities, external Teams accounts, and remote access tools.
The campaign affected organizations mainly in the United States and Canada between February and June 2026.
The connection between social engineering, remote access software, and ransomware deployment matches current ransomware trends.
✅ Confirmed: Chaos Ransomware Is Linked to Modern Extortion Operations
Chaos ransomware has been active since at least 2025 and follows the double-extortion model.
Attackers commonly combine data theft with encryption to increase pressure on victims.
The use of ransom notes and rapid encryption behavior aligns with known ransomware tactics.
❌ No Evidence: STAC4749 Was Connected to MuddyWater
Although some threat actors have previously used Chaos ransomware as a disguise for espionage operations, Sophos found no evidence linking this specific campaign to MuddyWater.
The STAC4749 operation appears financially motivated.
Prediction
(+1) Ransomware Defense Will Shift Toward Identity Protection
Organizations will increasingly invest in identity verification, AI-powered threat detection, and communication security controls.
Future security platforms will likely analyze not only malware behavior but also suspicious human interactions, unusual support requests, and abnormal employee communication patterns.
(-1) Attackers Will Continue Exploiting Trusted Platforms
Cybercriminals will continue abusing Microsoft Teams, Slack, Zoom, and other collaboration tools because these platforms naturally create trust.
Without stronger verification systems, fake support campaigns may become more frequent and more convincing.
The next ransomware outbreak may not start with a virus.
It may start with a simple message saying:
“Hello, I am from IT support. I can help you fix your computer.”
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.reddit.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
