Microsoft Teams vishing attacks lead to Chaos ransomware attacks

Threat actor group STAC4749 (tracked by Sophos) conducted vishing attacks via Microsoft Teams between February and June 2026, targeting North American organizations. Attackers impersonated IT helpdesk/support personnel using external Teams accounts registered under IT-themed '.top' TLD domains (e.g., sequrityupdate[.]top, scan-security[.]top). Fake personas used included Anthony Brooks, Dylan Harper, Ethan Parker, and Jason Mitchell. Calls lasted between 90 seconds and over 20 minutes. Victims were convinced to launch remote sessions via Microsoft Quick Assist or install RemSupp (cloud-based RMM tool). After gaining remote access, attackers used PowerShell to download a backdoor into the compromised user's %AppData% folder. The backdoor profiled the system, established persistence, and provided continued remote access. Persistence mechanisms were disguised as Realtek and Windows audio components using registry entries named 'Realtek HD Audio,' 'Realtek Audio UHD,' and 'WinAudio life2.' In ransomware-leading incidents, additional remote access tools (DWAgent, AnyDesk) were installed and RDP was enabled for lateral movement. At least three intrusions led to Chaos ransomware deployment, with ransom notes named 'readme.chaos.txt.' In one incident, the time from initial Teams contact to ransomware deployment was under 17 hours. Files were encrypted simultaneously across compromised devices. The attackers likely exfiltrated data before deploying ransomware in at least one case. The attack chain was continually modified between February and May 2026, with changing malware filenames, persistence mechanisms, and deployment methods to evade detection. The Chaos ransomware-as-a-service operation has been active since at least February 2025 and is believed linked to former members of BlackSuit and Royal ransomware gangs, which were spinoffs of the Conti cybercrime syndicate. Approximately 95% of attacks targeted organizations in Canada (50%) and the United States (45%), across sectors including services, manufacturing, energy, and construction/engineering.