STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam

STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam 1. Basic Information Article Name : Chaos in Teams vishing Publisher : Sophos Publication Date : 2026-07-28 (Detailed report by target site BleepingComputer on 2026-07-30) Original Source : https://www.sophos.com/en-us/blog/chaos-in-teams-vishing Related Source : https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ Related Entities : STAC4749, Chaos ransomware, Quick Assist, RemSupp, DWAgent, AnyDesk, PyInstaller backdoor, reverse SOCKS proxy Severity : High 2. Executive Summary An attacker uses an external Teams account to pose as IT support and tricks the user into allowing remote control. The attacker then deploys PowerShell, a custom loader, multiple RMM tools, and a SOCKS tunnel. This leads from lateral movement to simultaneous encryption in less than 17 hours at the shortest. 3. Attack Flow An external Teams account with an IT-like .top domain starts a chat and a call. The attacker poses as IT support and establishes a remote session using Quick Assist or RemSupp. The attacker runs PowerShell to download a loader from an external server and executes it in AppData\Roaming or similar folders. The loader collects device information, sets persistence via Run keys, and connects to the C2 server. A PyArmor-obfuscated PyInstaller backdoor runs shell commands, loads extra Python modules, and stages collected data. The attacker installs DWAgent and AnyDesk as backup access, enables RDP, and tries to move laterally. The sc5.exe reverse SOCKS proxy relays internal network traffic. The attacker steals data in at least one case, and then encrypts multiple devices with Chaos almost at the same time. 4. Attacker Locations and Execution Sites Initial contact occurs via an external Microsoft 365 tenant. Operations run through legitimate remote support tools on the victim device. Subsequent activities happen on Windows devices and the internal netwo