Anoymask

STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam

1. Basic Information

2. Executive Summary

An attacker uses an external Teams account to pose as IT support and tricks the user into allowing remote control. The attacker then deploys PowerShell, a custom loader, multiple RMM tools, and a SOCKS tunnel. This leads from lateral movement to simultaneous encryption in less than 17 hours at the shortest.

3. Attack Flow

  1. An external Teams account with an IT-like .top domain starts a chat and a call.
  2. The attacker poses as IT support and establishes a remote session using Quick Assist or RemSupp.
  3. The attacker runs PowerShell to download a loader from an external server and executes it in AppData\Roaming or similar folders.
  4. The loader collects device information, sets persistence via Run keys, and connects to the C2 server.
  5. A PyArmor-obfuscated PyInstaller backdoor runs shell commands, loads extra Python modules, and stages collected data.
  6. The attacker installs DWAgent and AnyDesk as backup access, enables RDP, and tries to move laterally.
  7. The sc5.exe reverse SOCKS proxy relays internal network traffic.
  8. The attacker steals data in at least one case, and then encrypts multiple devices with Chaos almost at the same time.

4. Attacker Locations and Execution Sites

Initial contact occurs via an external Microsoft 365 tenant. Operations run through legitimate remote support tools on the victim device. Subsequent activities happen on Windows devices and the internal network. The C2 infrastructure runs on attacker web servers, Workers.dev, and dedicated domains.

5. Visibility for Victims and Administrators

  • To the user, it looks like a short IT support call and a legitimate remote support screen.
  • To the administrator, it appears as Quick Assist or RemSupp, PowerShell, randomly named EXEs, Run keys, RDP settings changes, and multiple RMM tools.
  • Invasion and encryption happen very quickly. A small support issue during working hours grows into a company-wide incident on the same day.

6. Success and Failure Conditions

Success Conditions

  • External Teams contact is allowed, and the user approves remote control.
  • PowerShell and unauthorized RMM tools can run.
  • Application control, egress control, RDP restrictions, and network isolation are insufficient.

Failure Conditions

  • Limit Teams calls and chats with external tenants.
  • Users refuse and report the call based on internal IT identity verification procedures.
  • Control Quick Assist, RemSupp, DWAgent, AnyDesk, and unknown loaders.
  • Isolate the initial device and complete containment in under 17 hours.

7. What Happens on Success

The attacker gains persistent remote control, command execution, an internal proxy, and RDP lateral movement. After data theft, the attacker encrypts many devices almost simultaneously. They create readme.chaos.txt, leading to business interruption and double extortion.

8. Observable Logs

  • Email/Teams: External .top tenant, IT-like display name, calls lasting 90 seconds to 20 minutes, remote support requests.
  • Proxy/SWG/DNS: .top domain, Workers.dev, attacker web servers, legio[.]name, RMM traffic.
  • Endpoint/EDR: Quick Assist/RemSupp, PowerShell downloads, execution in AppData\Roaming, Run keys, PyInstaller/PyArmor, sc5.exe, DWAgent, AnyDesk, Chaos.
  • Identity/IdP: External Teams federation, abnormal conversations with external users, subsequent logins using compromised accounts.
  • SaaS/Cloud: Teams audits, external domains, call and chat records.
  • Network: Reverse SOCKS, RDP enabled/port 3389, simultaneous connections to multiple devices, and lateral movement before encryption.

9. Attack Success Assessment

  • Contact Only: External Teams message and call.
  • User Action: Remote session approval for Quick Assist/RemSupp.
  • Initial Execution: PowerShell and loader execution.
  • Malware or Auth Success: Backdoor C2, Run keys, RMM installation.
  • Data Theft/Session Compromise: Staging, large outbound traffic.
  • Subsequent Compromise Confirmation: RDP lateral movement, multiple RMMs, SOCKS, Chaos execution, simultaneous encryption.

10. Investigation Playbook

  • Trigger: External IT-like Teams call, PowerShell after Quick Assist, unauthorized RMM.
  • Initial Check: Identify the caller, domain, time, user approval, and remote session ID.
  • Endpoint: Preserve process trees, downloads, AppData, Run keys, services, RDP settings, Python files, and encryption traces.
  • Auth/Cloud: Check Teams audits, all contacts associated with the same external entity, and sign-ins of the victim ID.
  • Subsequent Activity: Track RMM installation sites, East-West traffic, SOCKS, staging, and backup destruction.
  • Containment: Isolate the initial and contacted devices, block external domains, stop RMM, change credentials, close RDP, and protect backups.
  • Assessment Stages: Contacted / Remote Session Approved / Payload Executed / Persistent Access / Lateral Movement / Exfiltration / Encryption.

11. Defense and Detection Ideas

  • Single Event: External .top Teams call, Quick Assist/RemSupp startup, randomly named EXE from Run keys, sc5.exe.
  • Timeline Correlation: Teams call -> Remote support -> PowerShell -> AppData execution -> Run keys/RMM -> RDP/SOCKS -> Simultaneous encryption.
  • Hunting: Search for contacts with the same external domain, use of multiple RMM tools, Workers.dev C2, and Python base_library.zip.
  • Log Gaps: Without detailed Teams audits and remote support logs, identifying the initial intrusion is difficult.
  • Priority Countermeasures: Control external Teams, verify remote support identities, apply application controls, maintain RMM allowlists, monitor PowerShell and EDR, and isolate networks.

12. Facts / Inference / Hypothesis

Facts

  • Sophos observed STAC4749 targeting dozens of organizations between February and June 2026.
  • At least 3 cases led to Chaos deployment, and 1 case took less than 17 hours from initial contact.
  • Quick Assist, RemSupp, DWAgent, AnyDesk, PyInstaller backdoors, and reverse SOCKS were used.

Inference

  • Attackers can adapt IT support scripts to any local language, so this is not a region-specific method.
  • Because legitimate RMM tools alone generate many false positives, correlating Teams contacts with process timelines is important.

Hypothesis

  • Combining remote support and PowerShell execution within 30 minutes of an external Teams call is effective for early blocking.

13. MITRE ATT&CK Mapping

  • High Confidence: T1566 Phishing, T1219 Remote Access Software, T1059.001 PowerShell, T1105 Ingress Tool Transfer, T1547.001 Registry Run Keys, T1021.001 RDP, T1090 Proxy, T1486 Data Encrypted for Impact.
  • Medium Confidence: T1041 Exfiltration Over C2 Channel, T1074 Data Staged, T1562 Impair Defenses.

14. Unknowns and Additional Investigation

  • Actions that users actually approved during the initial remote session
  • Credential theft methods and accounts used for lateral movement
  • Chaos distribution methods, encryption targets, and scope of stolen data
  • Use of the same infrastructure globally

15. Impact on SOCs and Organizations

Manufacturing, energy, construction, and legal services are frequent targets. Organizations that use external Teams federation and Quick Assist as a standard practice must review their controls and audits, assuming that attackers will abuse legitimate tools.

16. Summary by Target Audience

  • For SOC Teams: Trace the attack chain within 17 hours, starting from Teams contact to RMM, PowerShell, Run keys, RDP, and SOCKS.
  • For Administrators: Limit external Teams and unauthorized RMM tools. Tie the use of Quick Assist to tickets and identity verification.
  • For End Users: Even if a Teams contact claims to be from the IT department, verify through known internal channels before allowing remote control.