A short Microsoft Teams call can now become the first step in a ransomware attack. Attackers posing as IT support staff are persuading employees to grant remote access, then using that foothold to spread through networks and deploy Chaos ransomware.
The campaign, tracked as STAC4749, targeted dozens of North American organizations between February and June 2026.
Most fraudulent calls lasted only two to two-and-a-half minutes, showing how quickly social engineering can lead to a serious compromise.
Analysts from Sophos identified the activity as a financially motivated operation that combined Teams voice phishing, custom malware, and legitimate remote administration tools.
Sophos said in a report shared with Cyber Security News (CSN) that the attackers continually changed their methods to make detection harder.
The incidents underline a growing risk for organizations that trust collaboration platforms by default.
An employee does not need to open a malicious attachment or visit a fake website when an attacker can simply convince them to approve a remote-support session during a believable call.
A Two-Minute Microsoft Teams Call
STAC4749 operators began their attacks through Teams chats and voice calls, impersonating helpdesk or IT personnel.
They used convincing employee-style names and IT-themed cloud domains, making the accounts appear more credible to recipients who were already accustomed to receiving support requests online.
The callers sought access through Microsoft Quick Assist, a built-in remote-support utility, or an alternative remote-management application when Quick Assist was unavailable.
This reflects the same danger described in Teams Quick Assist impersonation attacks, where trusted workplace tools can hand attackers control of an endpoint within minutes.
Once the victim approved the session, attackers ran commands to collect information about the computer, identify security products, and establish a way back into the system.
They also attempted to enable Remote Desktop Protocol, allowing movement to other devices after the initial employee workstation was compromised.
The attackers initially used a custom loader before shifting to a Python-based backdoor delivered directly through the remote session.
This evolution reduced steps in the intrusion and helped operators move faster, while changing filenames and persistence methods made simple signature-based defenses less effective.
Encryption Follows Quickly
After securing access, STAC4749 deployed additional tools to maintain control and expand across the victim environment.
In several intrusions that ended with Chaos ransomware, the operators used secondary remote-access channels and a reverse proxy tool to communicate with systems inside the network.
At least three known STAC4749 compromises resulted in Chaos ransomware deployment. Encryption happened across endpoints almost at the same time, and one incident moved from initial access to ransomware deployment in less than 17 hours, leaving defenders little time to contain the attack.
Chaos has been active as a ransomware-as-a-service operation since at least February 2025.
Its use of voice phishing and remote-management tools is consistent with wider activity detailed in recent Chaos ransomware activity, where attackers seek quiet access before launching the disruptive encryption stage.
Defenders should treat unexpected external Teams messages and calls as suspicious, especially when someone asks a user to start remote-support software, install an application, or share access.
Employees should independently verify support requests through known internal contact channels instead of relying on the caller’s identity.
Security teams should monitor Teams activity, suspicious PowerShell use, unusual command-line activity, and unauthorized remote administration or tunneling tools.
Reviewing common Windows persistence locations, including registry Run keys, can also uncover hidden access before attackers return to deploy ransomware.
Organizations should restrict unauthorized software execution and apply controls around remote-support tools.
User awareness training remains essential, particularly as Teams and Google Drive abuse shows that attackers increasingly combine trusted cloud services with convincing social engineering to bypass traditional email-focused protections.
Indicators of Compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | sequrityupdate[.]top; scan-security[.]top; system-onine[.]top; system-connect[.]top; corp-connect[.]top; info-secure[.]top; supportsoft[.]top; update-syscontro[.]top | IT-themed domains used with spoofed Teams support accounts |
| Domain | sequpdate[.]top; service-cien[.]top; service-corporation[.]top; service-hep[.]top; it-service[.]top | Additional IT-themed domains linked to spoofed Teams accounts |
| Domain | scansequrity[.]top; sequritycheck[.]top; upsecscan[.]top | Additional IT-themed domains linked to spoofed Teams accounts |
| IP address | 94.140.114[.]192:443; 94.140.115[.]18:443; 94.140.115[.]129:443 | Hard-coded command-and-control addresses in the initial loader |
| URL | hxxps://fa5[.]flsdwnld[.]online/f5yxog/confirm[.]exe | Payload download location observed in a PowerShell command |
| IP address | 193.29.57[.]37 | Command-and-control server using a TLS certificate associated with multiple payloads |
| Domain | egio[.]name | Infrastructure used by the reverse SOCKS proxy tool |
| File name pattern | sekv[random 10-digit number].exe; helper[random 10-digit number].exe; 74fs[random 10-digit number].exe | Initial loader filename patterns |
| File name | updater.exe; 7414fs.exe; 45234ssdf403851640.exe; msupdate.exe | Python-based backdoor filenames |
| File name | confirm.exe; dizzy.exe; graph.exe; tube.exe; midnight.exe; shied.exe | Go-based implant filenames observed across compromises |
| File name | c5.exe | Reverse SOCKS proxy binary |
| File name | mklink-.vbs | Script used to create Startup-folder persistence |
| File name | SecurityHealth; OneDriveUpdate | Disguised Startup-folder shortcut names |
| Registry Run value | Realtek HD Audio Universal Service; Realtek HD Audio; Realtek Audio; WinAudio life2 | Masqueraded registry Run-key value names used for persistence |
| File name | readme.chaos.txt | Chaos ransomware note filename |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
