Teams Vishing: Hundreds of IT-Themed Attacks Lead to Chaos Ransomware

On October 26, 2026, security teams face a new standard scenario: hundreds of vishing attacks via Microsoft Teams external chat using IT-themed display names, culminating in Chaos ransomware deployment.

On October 26, 2026, security teams face a new standard scenario: hundreds of vishing attacks conducted through Microsoft Teams external chat, with IT-themed display names and final deployment of Chaos ransomware. Arctic Wolf Labs and Sophos have documented a systematic campaign, attributed to group STAC4749, that turns a productivity feature into a privileged-access tunnel.

The attack exploits no software vulnerability but abuses legitimate functionality: Teams external access, commercial Remote Monitoring and Management (RMM) tools, Azure Blob Storage, and PowerShell. The speed of execution — 17 hours from first contact to network encryption — and the use of legitimate tools make detection extremely difficult for traditional defenses.

Key Takeaways

Arctic Wolf Labs documented hundreds of cases with an identical pattern: the same throwaway tenants, the same IT-themed display names, the same RMM tools, and converging payload domains.
Sophos tracked group STAC4749 across dozens of North American organizations between February and June 2026, with 50% of cases in Canada and 44% in the United States.
Attackers use throwaway tenants with .top and .onmicrosoft.com domains, evolving toward paid TLDs to increase plausibility.
The malware includes a custom loader with gRPC C2, a Python backdoor for LDAP reconnaissance, and persistence via registry keys masquerading as Realtek/WinAudio audio components.

How the Teams Trust Exploit Works

The compromise chain begins with a message in Teams external chat. The attacker presents a display name such as "IT Service Desk – Liam," "IT Service Desk – Matt," or "IT Service Desk – Scott." Arctic Wolf Labs observed a consistent pattern: the same names recur across hundreds of incidents, sometimes with the target organization's domain name appended for added credibility.

30-40% of cases use auto-generated *.onmicrosoft[.]com domains from Microsoft 365 tenants. A growing share — roughly 50% — shifts to paid TLDs, particularly .top, with about 40% on .com and the remaining 5% on multi-level domains such as .com.pl, .com.vn, and .com.br. Sophos identified examples like sequrityupdate.top and scan-security.top associated with group STAC4749.

According to Arctic Wolf Labs, "External Microsoft Teams chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability." The external-user warning that Teams displays is neutralized by the familiarity of the display name and the apparently legitimate context.

From First Contact to Persistence: The STAC4749 Timeline

After initial engagement, the attacker induces the victim to install a remote-access tool. Sophos documented the evolution of the group's preferences: Quick Assist initially, then RemSupp as a fallback, and from April 2026 a stable preference for RemSupp given its lower presence on commercial blocklists. Other observed RMM tools include AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn, Level, and DWAgent.

Once access is obtained, the attacker guides the victim to execute PowerShell to download an MSI package from Azure Blob Storage. The installer extracts and executes a Python implant. Sophos analyzed a custom loader that communicates with C2 via gRPC to hardcoded IPs: 94.140.114.192:443, 94.140.115.18:443, and 94.140.115.129:443.

The Python backdoor gathers system identifiers — computer name, machine GUID, OS version — and detects active security products. Persistence is established via a registry Run key masquerading as Realtek or WinAudio audio components. Sophos measured scam call durations from 90 seconds to over 20 minutes, with the majority concentrated between 2 and 2.5 minutes.

"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains" — Arctic Wolf Labs

LDAP Reconnaissance, Lateral Movement, and Chaos Deployment

Post-installation, the malware runs LDAP queries against Active Directory to map the network. Sophos documented lateral movement via RDP enablement through msconfig, a technique that avoids more heavily monitored remote-access tools. In several cases the compromise culminated in Chaos ransomware deployment.

Cybersecurity Dive, reporting Sophos data dated July 2026, documented at least three cases with Chaos deployment and a 17-hour window between initial access and encryption. Chaos ransomware-as-a-service has been active since February 2025, with documented links to former BlackSuit group members. Sophos confirmed that "In several incidents, attackers later leveraged this access to deploy Chaos ransomware."

STAC4749's target sectors reflect a non-random strategy: services (20%), manufacturing (17%), energy (12%), construction/engineering (12%). Sophos also identified systematic targeting of legal organizations specializing in IP law, suggesting a specific interest in proprietary data.

Why Email-Centric Defenses Fail

The Teams vector inverts the logic of traditional perimeter defenses. Email anti-phishing controls — Safe Links, ZAP scanning, attachment sandboxing — do not intercept Teams conversations. Arctic Wolf Labs observed that attackers deliberately avoid pasting URLs directly into chat, "which would trigger Safe Links / ZAP scanning, and instead navigate to the payload themselves during the remote session."

The use of legitimate RMM tools further complicates the picture. These tools generate signed traffic that is often whitelisted, bypassing EDR controls based on file reputation. Detection therefore requires an identity-centric model: correlating Teams access, non-standard RMM installation, and PowerShell execution within the same session timeframe.

What to Do Now

Organizations with Microsoft Teams external access enabled must assume this vector is active and prioritize specific controls.

Reduce or disable Teams external access: limit external chat enablement to whitelisted domains, with documented managerial approval for each new domain.
Monitor unmanaged RMM tool installations: correlate execution of Quick Assist, RemSupp, AnyDesk, and similar tools with verified support tickets; flag instances without prior mapping.
Enable logging and alerting on PowerShell execution during remote-assistance sessions: track downloads from cloud storage (Azure Blob, AWS S3) during remote-support intervals.
Train users on vishing over non-email channels: explicitly include Teams, Slack, and other collaboration platforms in security awareness programs, with simulations replicating IT-themed display names.

The Geography of an Actor and the Limits of Attribution

Sophos explored possible links between STAC4749 and MuddyWater, a group generally associated with Iranian strategic interests, but ruled out this reconstruction. According to the vendor, STAC4749 is "linked to a criminal actor" financially motivated. No infrastructure overlaps with state-sponsored actors emerge in the published evidence.

Gray areas remain. The exact number of compromised organizations is not precisely quantified: "hundreds of cases" is Arctic Wolf Labs' metric, but not all necessarily led to ransomware or complete exfiltration. It is also unclear whether the October 26, 2026 activity represents a new operational wave or a public synthesis of prior campaigns.

The Structural Problem of Collaborative Apps

The STAC4749 campaign is not an isolated incident but proof of a systematic vector shift. Enterprise collaboration platforms are designed to break down communication barriers; attackers exploit precisely this architecture. The trust users associate with Teams — different from the wariness now internalized toward email — becomes the attack surface.

The response cannot be purely technical. Fully disabling Teams external access carries real operational costs for organizations with extended ecosystems. The challenge for security teams is to build detection that does not depend on the presence of a software exploit but on understanding legitimate workflow and its deviations.

FAQ

Is Teams external access vulnerable by design?

No. The attack exploits no software vulnerability but abuses the legitimate external-chat function, underscoring how collaborative-interface security requires dedicated controls beyond traditional email security.

Why do attackers prefer RemSupp over Quick Assist?

Sophos documented a shift from April 2026 toward RemSupp because it has a lower presence on commercial security blocklists, reducing the likelihood of automatic blocking during installation.

What is the average reaction time needed to stop the attack?

Sophos measured 17 hours between initial access and Chaos ransomware deployment in at least one case. This interval defines the maximum time available to interrupt the compromise chain.

Sources

Sources and references

Get DeafLetter