STAC4749: Chaos Ransomware Group Encrypts Networks via 2-Minute Microsoft Teams Calls
Sophos X-Ops has documented 100+ organizations hit by a threat group that dials employees on Teams, impersonates IT helpdesk, and deploys Chaos ransomware in under 17 hours
Proactive Security for the AI Era
NodeZero continuously and autonomously pentests infrastructure, identity, cloud, and now web applications, chaining weaknesses across every domain the way real attackers do. Every finding ships with replayable proof showing exploitable business impact, not theoretical risk.
Three North American manufacturing firms had their networks encrypted within 17 hours of answering a two-minute Microsoft Teams call in early 2026, part of a campaign Sophos X-Ops has named STAC4749 and linked to former operators of the BlackSuit and Royal ransomware gangs. STAC4749 operators create Microsoft Teams accounts under fake corporate display names like Anthony Brooks and Dylan Harper, then dial employees impersonating IT helpdesk staff and requesting a remote access session via Microsoft Quick Assist or a cloud-based remote management tool called RemSupp.
The attack mechanism requires no CVE, no phishing email, and no malicious attachment. Once an employee grants screen control, the attacker opens PowerShell and downloads a first-stage backdoor to the user's AppData folder, establishes HKCU registry persistence under keys disguised as Realtek HD Audio drivers, and installs DWAgent and AnyDesk as parallel remote access channels. A custom Golang implant suite beacons to three hardcoded C2 IP addresses on port 443 before the Chaos ransomware payload is pushed simultaneously across the network.
Sophos X-Ops documented STAC4749 activity across 100+ organizations between February and June 2026, with at least three confirmed Chaos ransomware deployments. Approximately 95% of victims are North American: 50% Canadian, 45% American. The campaign targets organizations in services, manufacturing, energy, and construction, sectors where employees are conditioned to accept unexpected IT support calls. The most important fact about STAC4749 is also the most alarming: the entire attack chain from first Teams contact to encrypted endpoints takes fewer than 17 hours and costs the attacker nothing but a free Microsoft account and a two-minute phone call.
Who Is STAC4749 and Where Did Chaos Ransomware Come From?
Sophos X-Ops began tracking STAC4749 in February 2026 after responding to a Microsoft Teams-based intrusion at a North American manufacturing firm. By June 2026, the group had targeted more than 100 organizations and achieved three confirmed Chaos ransomware deployments that caused significant operational disruption.
Sophos assesses with moderate confidence that STAC4749 includes former operators of BlackSuit and Royal, ransomware operations that both emerged from the Conti syndicate. Royal launched in September 2022, targeting healthcare and critical infrastructure with ransom demands averaging $4.7 million. It rebranded as BlackSuit in mid-2023 and claimed the 2024 CDK Global attack, which disrupted automotive dealership networks across North America for three weeks. Chaos ransomware is assessed to have been launched by GOLD SOUVENIR, Sophos's tracking cluster for the BlackSuit operation, following increased law enforcement pressure in late 2025.
Russian-language indicators appear in the STAC4749 toolkit. A mistyped Cyrillic command string consistent with a Russian keyboard layout was recovered from a C2 session. Sophos explicitly stated this is insufficient for definitive attribution to any state or criminal group. Rapid7 in May 2026 suggested Chaos may serve as a false flag for MuddyWater, an Iranian state-sponsored actor, but Sophos found no technical evidence of this in any STAC4749 incident response. No government indictment, law enforcement action, or formal threat actor designation has been issued against STAC4749 operators as of August 2026.
How Does the STAC4749 Attack Chain Work?
STAC4749 executes a consistent six-phase attack that exploits Microsoft Teams external access and enterprise helpdesk culture. The entire chain requires no technical vulnerability and succeeds entirely through social engineering followed by scripted post-exploitation.
Phase 1 is contact. Operators register free Microsoft accounts using corporate-looking display names and dial target employees via Teams. Microsoft Teams external access, enabled by default in most enterprise tenants, allows any external Teams account to initiate chats and calls with internal users. The calls last an average of two to two-and-a-half minutes.
Phase 2 is remote access. The caller asks the employee to launch Microsoft Quick Assist, a Windows-native remote access utility built into Windows 10 and 11 that requires no download or installation. From April 2026 onward, STAC4749 shifted preference to RemSupp, a cloud-based remote management tool that bypasses endpoint controls blocking Quick Assist. The employee reads a six-digit access code back to the caller, granting full remote screen control.
Phase 3 is backdoor deployment. The attacker opens PowerShell in the remote session and runs a download-and-execute command fetching the first-stage payload from an attacker-controlled .top domain to %AppData%. The implant establishes a C2 channel to hardcoded IP addresses on port 443 using gRPC over HTTPS with certificate pinning.
Phase 4 is persistence. The implant writes HKCU registry Run keys with names mimicking legitimate audio drivers. Initial variants used Realtek HD Audio Universal Service; later variants cycled through Realtek HD Audio, Realtek Audio UHD, and WinAudio life2 to evade signature detection on earlier indicators.
Phase 5 is lateral movement. DWAgent and AnyDesk are silently installed for parallel remote access channels. RDP is enabled via msconfig modification. A custom reverse SOCKS proxy, sc5.exe, supports up to 1,000 concurrent connections and relays lateral movement traffic through legio[.]name.
Phase 6 is ransomware. Chaos ransomware is pushed simultaneously across discovered endpoints. Ransom notes appear as readme.chaos.txt on all encrypted systems.
Teams vishing: 2-min helpdesk impersonation call
Attacker dials target employee via external Microsoft Teams account using a spoofed corporate display name (Anthony Brooks, Dylan Harper). Calls average two to two-and-a-half minutes. Employee is told their system needs a security check or patch applied.
Remote access via Quick Assist or RemSupp
Employee is instructed to launch Microsoft Quick Assist or RemSupp and read back the session code. This grants the attacker full remote screen control with no additional authentication required. No malicious software has been installed at this point.
PowerShell backdoor download to %AppData%
Attacker uses the remote session to open PowerShell and download the first-stage loader (confirm.exe, shield.exe, or similar single-word filename) from an attacker-controlled .top domain. Executed with a --token-raw authentication argument. The implant beacons to three hardcoded C2 IP addresses on port 443.
Registry Run key persistence under fake audio driver names
The implant creates HKCU\Software\Microsoft\Windows\CurrentVersion\Run keys named Realtek HD Audio, Realtek Audio UHD, or WinAudio life2 pointing to the backdoor executable path. On non-Realtek systems, these keys have no legitimate counterpart and are reliable detection indicators.
Lateral movement: AnyDesk + RDP + SOCKS proxy
AnyDesk and DWAgent are silently installed for persistent remote access. RDP is enabled via msconfig. sc5.exe, a custom reverse SOCKS proxy, is deployed to relay traffic through legio[.]name across up to 1,000 concurrent connections, enabling rapid propagation across the network.
Chaos ransomware deployment across all endpoints
Chaos ransomware is pushed simultaneously to all discovered endpoints and executed. Files are encrypted and readme.chaos.txt ransom notes appear across all encrypted systems. The fastest documented case went from initial Teams contact to network-wide encryption in under 17 hours.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
STAC4749 MITRE ATT&CK TTP Mapping
STAC4749's technique stack covers six ATT&CK phases, with particular depth in initial access via social engineering and defense evasion through legitimate tool abuse.
Initial Access (TA0001): T1566.002 (Phishing: Spearphishing via Voice). Teams vishing is the sole initial access technique -- STAC4749 does not use email phishing, CVE exploitation, or stolen credentials for entry.
Execution (TA0002): T1059.001 (Command and Scripting: PowerShell) for backdoor download and execution via Invoke-WebRequest. T1648 (Serverless Execution) covers RemSupp's cloud-relay architecture that circumvents direct inbound connection blocking.
Persistence (TA0003): T1547.001 (Registry Run Keys) via fake Realtek and WinAudio HKCU Run entries. T1547.009 (Startup Folder) via .vbs shortcut files placed in the user's Startup directory with hidden attributes.
Defense Evasion (TA0005): T1140 (Deobfuscation: Decode Files) via PyArmor-obfuscated Python implants and base64-encoded C2 IP addresses embedded in the payload. T1036 (Masquerading) via audio driver naming conventions for persistence keys and legitimate-sounding executable names (confirm.exe, shield.exe).
Command and Control (TA0011): T1071.001 (Application Layer: Web Protocols) via gRPC and HTTPS C2 with certificate pinning using internally issued CA certificates (loop-CA, connectify-CA, james-bond-CA). T1090.004 (Proxy: Domain Fronting) via sc5.exe reverse SOCKS proxy to legio[.]name. T1219 (Remote Access Software) via Quick Assist, RemSupp, DWAgent, and AnyDesk in parallel.
Impact (TA0040): T1486 (Data Encrypted for Impact) via Chaos ransomware deployed network-wide.
STAC4749 Infrastructure, Tooling, and Active IOCs
The STAC4749 tool suite evolved steadily between February and June 2026, cycling through four distinct loader naming conventions and two remote access tool preferences to evade detection on earlier-discovered indicators. The full IOC set is published by SophosLabs at their GitHub repository for direct import into threat intelligence platforms.
The C2 infrastructure relies on hardcoded IP addresses on port 443 rather than domain-based C2, making traditional domain blocklisting insufficient. Three primary C2 IP addresses were identified: 94.140.114.192, 94.140.115.18, and 94.140.115.129. A fourth IP, 193.29.57.37, was identified via its unusual TLS certificate with CN=james-bond-CA, an internally issued CA certificate embedded in the Golang implant binaries.
Fake IT support domains using the .top TLD serve as the Microsoft Teams profile domains and in some cases as payload hosting infrastructure. Any Teams chat or call originating from these domains should be treated as a STAC4749 social engineering attempt and immediately blocked.
See the STAC4749/Chaos TTPs also apply to other vishing-based ransomware attacks documented at BlackFile Extortion Group and ShinyHunters enterprise vishing campaigns, which use similar social engineering entry points against different sectors.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Sigma Detection Rules for STAC4749 Activity
No CVE-specific Sigma rule exists for STAC4749 because the attack chain involves no vulnerability exploitation. The rules below target the post-access behaviors that are reliably observable in endpoint telemetry: PowerShell execution from AppData, AnyDesk silent installation used in STAC4749's lateral movement phase, and anomalous binary writes through AnyDesk sessions.
Deploy the PowerShell AppData rule in your SIEM against Windows process creation logs (Sysmon Event ID 1 or Windows Security Event ID 4688 with command line auditing enabled). Deploy the AnyDesk rules against endpoint file and process creation logs. All three rules should run in detection mode before alerting mode, as AnyDesk has legitimate enterprise uses that will produce false positives in environments that deploy it for authorized IT support.
WAF rules skipped for this post -- STAC4749's attack surface is host-based social engineering with no web-facing HTTP exploit pattern.
Subscribe to unlock Sigma Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Current STAC4749 Targeting and Why Your Sector Is at Risk
STAC4749 targets organizations where employees regularly receive IT support calls and are trained to cooperate with helpdesk requests. The group's victim selection is not random: services firms, manufacturers, energy operators, and construction companies share a workforce demographic that is less security-aware than dedicated IT staff and more likely to comply with an unexpected Teams call asking for remote access.
The Canadian concentration (50% of victims) aligns with the workforce profile of large manufacturing and construction sectors that use Microsoft 365 extensively but have smaller dedicated security teams than comparable U.S. organizations. Canadian organizations also tend to have less mature Teams external access policies.
Organizations using Microsoft Teams with external access enabled and no application control policy blocking Quick Assist or RemSupp face the highest exposure. The STAC4749 attack chain has no technical barrier to entry for the attacker: a free Microsoft account and knowledge of a target employee's name is sufficient to initiate contact.
The Chaos ransomware payload deployed at the end of the chain is not currently decryptable without the attacker's private key. No free decryptor exists. Organizations that do not stop STAC4749 at the initial access or persistence phase face full encryption with no technical recovery option beyond validated backups.
“Less than 17 hours passed between the initial Microsoft Teams contact and the deployment of ransomware across the target network.”
Sophos X-Ops, Chaos in Teams Vishing (July 2026)
How to Stop STAC4749 Before Chaos Ransomware Deploys
STAC4749 is one of the few ransomware threat groups where the initial access vector is completely blockable without patching a CVE or deploying a new security product. The attack chain has three points where a single control eliminates the entire vector: restricting Teams external access, blocking approved remote access tools, and detecting the persistence mechanism before lateral movement begins.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
The bottom line
STAC4749 demonstrates that the most dangerous ransomware attack chain in 2026 requires no CVE, no phishing email, and no malware delivered to the victim. Microsoft Teams vishing ransomware attacks succeed entirely because employees trust the IT helpdesk, Microsoft enables external calling by default, and Quick Assist requires no installation. Restrict Teams external access to approved domains today, block Quick Assist and RemSupp at the application control layer, and hunt for Realtek or WinAudio registry persistence keys on non-Realtek hardware. These three controls eliminate STAC4749's entire attack chain before the 17-hour clock starts.
This analysis is generic. create a free account to score threats like this against your own stack.
Frequently asked questions
Who is the STAC4749 threat group?
STAC4749 is a financially motivated cybercriminal group first documented by Sophos X-Ops in February 2026. The group uses Microsoft Teams voice calls to impersonate corporate IT helpdesk staff, tricks employees into granting remote access via Quick Assist or RemSupp, deploys a custom implant suite, and installs Chaos ransomware across the target network. Sophos assesses with moderate confidence that STAC4749 includes former operators of the BlackSuit and Royal ransomware gangs, both successors to the Conti syndicate. No government indictment or formal APT designation has been issued as of August 2026.
What is Chaos ransomware?
Chaos ransomware is a ransomware-as-a-service operation reportedly launched by former members of GOLD SOUVENIR, the tracking cluster associated with the BlackSuit ransomware gang. The Chaos payload encrypts files across Windows endpoints and drops ransom notes named readme.chaos.txt. It is the final payload deployed in STAC4749 intrusions after initial access via Teams vishing, implant persistence, and lateral movement via AnyDesk and RDP. No free Chaos decryptor exists as of August 2026.
How does Microsoft Teams vishing work?
Microsoft Teams vishing (voice phishing) exploits Teams' external access feature, which allows users outside an organization to initiate calls and chats with internal employees by default. STAC4749 operators create free Microsoft accounts with corporate-sounding display names, then call target employees impersonating IT helpdesk staff. The calls last on average two to two-and-a-half minutes. The caller asks the employee to launch Microsoft Quick Assist or RemSupp, a cloud-based remote management tool, and reads back an access code to grant the attacker full remote control over the endpoint.
Which sectors does STAC4749 target?
Sophos X-Ops documented STAC4749 targeting across services (20% of incidents), manufacturing (17%), energy (12%), and construction and engineering (12%), with the remaining incidents distributed across other sectors. Geographic concentration is heavy in North America: approximately 50% of victims are Canadian organizations and 45% are U.S.-based. The group's reliance on IT helpdesk impersonation means organizations with larger non-technical workforces that are conditioned to accept unexpected IT support calls face the highest exposure.
How do I detect STAC4749 activity before ransomware deploys?
Key detection opportunities include: unexpected Quick Assist or RemSupp sessions initiated by external contacts, PowerShell processes launching executables from %AppData%, HKCU registry Run keys with names matching Realtek HD Audio or WinAudio life2 on systems without Realtek hardware, AnyDesk or DWAgent silently installed from AppData, anomalous RDP enablement via msconfig, and outbound connections to .top domains or the known C2 IP addresses 94.140.114.192, 94.140.115.18, 94.140.115.129, and 193.29.57.37. Deploy EDR with behavioral rules covering all four detection categories.
How do I stop Microsoft Teams impersonation attacks?
Disable or restrict Teams external access to prevent unapproved external accounts from initiating calls to your organization. If business requirements prevent full disabling, configure Teams to restrict external calls to an approved list of partner domains. Block Quick Assist and RemSupp at the application control layer on all endpoints not explicitly approved for IT use. Run targeted security awareness training that explains IT helpdesk staff will never call employees unprompted via Teams and will never ask for Quick Assist screen-share codes. These three controls together eliminate the STAC4749 initial access vector entirely.
What is the connection between STAC4749, BlackSuit, and Royal ransomware?
Sophos assesses STAC4749 includes former members of BlackSuit, a ransomware gang that emerged from the Royal ransomware operation in mid-2023. Royal itself was a direct successor to the Conti ransomware syndicate that executed the 2022 Costa Rica government attack and numerous other high-profile operations. BlackSuit claimed the 2024 CDK Global attack, which disrupted automotive dealer operations across North America for weeks. GOLD SOUVENIR, the Sophos tracking cluster for BlackSuit, reportedly launched the Chaos ransomware operation following law enforcement pressure in late 2025.
Has STAC4749 been linked to a nation-state?
Sophos found no evidence of nation-state affiliation. Russian-language indicators appear in the STAC4749 toolkit, including a mistyped Cyrillic command string vshk consistent with a Russian keyboard layout, but Sophos explicitly noted these are insufficient for definitive attribution. Rapid7 in May 2026 suggested Chaos ransomware may be used as a false-flag operation by MuddyWater, an Iranian state-sponsored group tracked as COBALT ULSTER, but Sophos found no technical evidence supporting this assessment in the STAC4749 intrusions. The group's behavior is consistent with financially motivated criminal activity.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.