Teams Vishing Turns Helpdesk Trust Into Chaos Ransomware in Hours

Threat actors posing as IT support staff used Microsoft Teams voice calls to gain remote access and deploy Chaos ransomware against dozens of North American organizations, with one intrusion reaching full encryption in less than 17 hours.

Sophos tracked the activity as STAC4749 from February through June 2026. About 95 percent of targets sat in Canada and the United States. The campaign shows how a two-minute social-engineering window plus everyday remote tools can open a direct path to double-extortion ransomware.

Two-Minute Calls From Fake Helpdesks

Attackers started with external Microsoft Teams chats and voice calls. They impersonated helpdesk or IT support personnel. Most successful calls lasted two to two-and-a-half minutes; the full observed range ran from 90 seconds to more than 20 minutes.

That narrow window matters. Once the employee accepts the voice request, there is little room left for a second check with a manager or a callback to a known IT number. The social engineering is built for speed, not for long persuasion.

Instead of the older onmicrosoft.com tenant trick, operators registered IT-themed domains under the .top TLD. Fake personas carried names such as Anthony Brooks, Dylan Harper, Ethan Parker and Jason Mitchell, each tied to specific domains.

• AnthonyBrooks paired with sequrityupdate.top, scan-security.top, system-connect.top, corp-connect.top and supportsoft.top
• DylanHarper with sequpdate.top, service-clien.top and system-connect.top
• EthanParker with scansequrity.top and info-secure.top
• Additional aliases including EllaBrooks, RyanBennett and LoganCooper used overlapping .top domains

The goal was simple: persuade the employee to start a remote support session. Operators first preferred Microsoft Quick Assist. When that tool was blocked they switched to the cloud-based RemSupp RMM. By April they favored RemSupp because it appeared less often on corporate blocklists.

Shared domains across personas, such as system-connect.top appearing with more than one alias, point to a small operator pool reusing infrastructure rather than fully separate crews. The .top registrations and IT-flavored names were enough to look plausible inside a brief Teams call.

North American Services and Factories Took the Brunt

Nearly 95 percent of observed STAC4749 cases hit Canada (50 percent) and the United States (44-45 percent). The remaining share was scattered.

Sectors broke down as follows:

Services and manufacturing together account for more than a third of the observed cases. Energy and construction each match at 12 percent, so no single vertical dominates the rest of the set.

All legal organizations targeted specialized in intellectual property law or services. The pattern fits opportunistic big-game hunting rather than a single vertical campaign.

On X, defenders immediately flagged the short call window and urged checks of external Teams logs for the named .top domains. The living-off-the-land approach means the user who opens the remote tool becomes the perimeter.

Realtek Keys Hid the Backdoor

Once inside the remote session, attackers launched PowerShell to pull a loader or backdoor into the user’s %AppData% folder. Early loaders used filenames such as sekv followed by a 10-digit string, then helper*, then 74fs*. By mid-April they often skipped the separate loader and dropped the backdoor directly.

Persistence relied on HKCU Run keys dressed up as audio components:

The naming drift tracks the campaign months. Early keys lean on the longer Realtek HD Audio Universal Service label and Temp paths. Later keys shorten the brand text and move payloads into Roaming, then adopt WinAudio and msupdate-style names that blend with ordinary update traffic.

Secondary persistence used .vbs scripts to plant hidden Startup folder shortcuts named like SecurityHealth or OneDriveUpdate. The PyArmor-obfuscated Python backdoor fetched an AES key from a public GitHub repository, decrypted its config, and pulled Golang implants that authenticated with a –token-raw argument. Certificate pinning (issuers such as loop-CA, connectify-CA, james-bond-CA) locked each implant to specific C2 servers.

In Chaos cases the operators also installed DWAgent or AnyDesk for backup access and tried to enable RDP via msconfig changes for lateral movement. One incident included a custom reverse SOCKS proxy.

Layered access is the point. If one RMM path is later removed, DWAgent, AnyDesk, or the SOCKS proxy can still keep the operators on the host while encryption staging continues.

Chaos Arrives in Under 17 Hours

At least three STAC4749 compromises ended with Chaos ransomware. Encryption hit multiple endpoints nearly simultaneously. Ransom notes named readme.chaos.txt claimed data theft and threatened leaks. In one case the gap from first Teams contact to encryption was less than 17 hours.

Given the short interval between initial access and encryption, Sophos analysts assess with high confidence that STAC4749 was a financially motivated operation that either directly deployed ransomware or coordinated with affiliates.

Morgan Demboski of Sophos wrote the assessment in the Sophos STAC4749 campaign analysis. Limited hands-on keyboard artifacts included a mistyped Russian-layout command, but Sophos found no evidence linking the cluster to the Iranian group MuddyWater, which has used Chaos as a decoy in other operations.

Simultaneous encryption across endpoints implies the operators had already staged payloads and credentials before the final detonation. The ransom note’s dual claim of encryption plus theft matches the double-extortion model Chaos markets elsewhere.

Chaos Carries Conti DNA

Chaos ransomware-as-a-service has been active since at least February 2025. A Talos assessment of Chaos RaaS origins concluded with moderate confidence that former members of the BlackSuit (Royal) operation formed the group. BlackSuit itself spun out of Conti. The group markets cross-platform encryption (Windows, ESXi, Linux, NAS), runs a data-leak site, and adds DDoS threats for non-payers. It avoids BRICS/CIS, hospitals and government targets in its public pitches.

Earlier Chaos-linked activity already featured IT-themed Teams vishing and Quick Assist abuse. Sophos earlier documented similar playbooks feeding 3AM ransomware, also tied to ex-BlackSuit operators. The Conti-to-Royal-to-BlackSuit-to-Chaos chain keeps recycling proven social-engineering and RMM abuse techniques under fresh brands.

The lineage shows up in tactics more than in branding. Teams vishing, Quick Assist or other RMM entry, rapid staging, and a leak-site threat form a reusable kit. Fresh names change what defenders search for first; the underlying sequence stays familiar.

Why RemSupp Replaced Quick Assist

Operators continually refined the chain between February and May 2026. Filenames, registry keys and deployment order changed to dodge static detections. They tested DLL sideloading with a legitimate CopyQ binary. In one intrusion both old and new naming schemes appeared on different hosts a day apart, showing mid-attack iteration.

1. February-March: Quick Assist preferred; sekv* loaders and Realtek HD Audio Universal Service Run keys dominate.
2. March-April: helper* payloads and shorter Realtek HD Audio keys appear; separate loaders still common.
3. April onward: RemSupp favored over Quick Assist; direct backdoor drops increase; 74fs* and later msupdate or path1 names surface.
4. Through May: WinAudio-style keys, CopyQ sideloading tests, and Cloudflare-fronted payload domains such as filesdwnld and fldwnld complete the modular kit.

The shift toward RemSupp after April reduced reliance on a Windows-built-in tool that more organizations had begun blocking. Payload domains clustered around filesdwnld, fldwnld and similar Cloudflare-fronted names. The speed and modularity let affiliates move from initial access to ransomware before many SOCs finished triage.

Seeing old and new schemes on different hosts a day apart shows the operators did not wait for a full campaign reset. They adjusted naming and tool choice while an intrusion was still live.

How the Two-Minute Window Enables Double Extortion

The short Teams call is only the first link. Once RemSupp or Quick Assist is running, PowerShell can place the loader, the Run key can secure reboot survival, and backup RMMs can open parallel paths. That stack turns a brief voice session into durable control.

From there the path to Chaos is mostly logistics. Golang implants authenticated with a –token-raw argument, configs unlocked by a GitHub-hosted AES key, and certificate pinning to issuers such as loop-CA, connectify-CA, and james-bond-CA keep C2 traffic tightly scoped. Staging finishes before many alert queues surface the initial external call.

Double extortion then rides the same access. Ransom notes claiming theft and leaks do not require a separate phishing wave; the operators already hold the session that collected files and reached multiple endpoints. The less-than-17-hour case shows how little time defenders have once the employee accepts the fake helpdesk request.

Affiliates benefit from that compression. Initial access, persistence, and ransomware deployment can sit inside one continuous operator shift rather than a multi-day dwell that invites deeper hunting.

Controls That Cut the Pipeline

Default Teams external access and readily available remote tools create the opening. Defenders can shrink it with layered changes that still allow legitimate support.

• Monitor and alert on external Teams chats and voice calls, especially from unknown .top or recently registered domains; review logs for the known personas.
• Restrict or disable external access via the Teams external access admin controls and apply user policies that limit who can receive external calls.
• Block or remove Quick Assist where it is not required; Microsoft documents how to disable Quick Assist endpoints by blocking the primary remoteassistance.support.services.microsoft.com traffic (note the impact on Remote Help).
• Apply application control and EDR rules that flag unexpected PowerShell downloads into AppData, new HKCU Run keys named after audio components, and unauthorized RMM installs such as RemSupp, DWAgent or AnyDesk.
• Train staff that genuine IT support will never cold-call via Teams and demand an immediate remote session; establish a verified callback process.
• Audit registry Run keys and Startup folders regularly for the Realtek/WinAudio and SecurityHealth-style artifacts.

No single control closes every path. Blocking Quick Assist pushes operators toward RemSupp; catching one Run key name still leaves Startup shortcuts and secondary RMMs. The list works as a stack: reduce who can be called, reduce which remote tools will launch, and alert when AppData or audio-themed persistence appears anyway.

Microsoft has poured resources into cheaper specialist models for cyber work, including efforts described in coverage of Microsoft routing cyber work to specialist models. Those investments help at scale, yet the STAC4749 chain still succeeds when a single employee accepts a two-minute voice request.

Organizations that treat every unexpected Teams support call as hostile until verified close the fastest path the operators currently enjoy.

What the Geographic Bias Signals for Defenders

Canada at roughly half of cases and the United States at 44 to 45 percent leave little of the observed volume elsewhere. English-language IT personas, Teams as the call channel, and daytime support framing fit that North American concentration.

Sector mix reinforces an opportunistic read. Services at 20 percent and manufacturing at 17 percent lead, yet energy, construction and engineering, and IP-focused legal firms still appear. The operators appear to take whoever answers the fake helpdesk call, not a single industry list.

For defenders in those regions, external Teams log review for the named .top domains and personas is a direct match to how STAC4749 begins. Pairing that review with blocks on unexpected RMM installs addresses both the voice entry and the remote-session handoff that follows.

Frequently Asked Questions

What is the STAC4749 campaign?

STAC4749 is the Sophos tracking name for a financially motivated Microsoft Teams voice-phishing operation active from February to June 2026 that used fake IT personas on .top domains to obtain remote access and, in at least three cases, deploy Chaos ransomware.

How long did successful STAC4749 calls usually last?

Most completed in roughly two to two-and-a-half minutes, although observed calls ranged from 90 seconds to more than 20 minutes; the short window left little time for second thoughts or verification.

Is Chaos ransomware connected to Conti or BlackSuit?

Yes. Cisco Talos assessed with moderate confidence that Chaos was formed by former BlackSuit (Royal) members; BlackSuit itself descended from Conti, and the group reuses overlapping encryption methods, ransom-note structures and RMM-heavy playbooks.

Can organizations disable Quick Assist to block this attack path?

Yes. Administrators can block traffic to the primary Quick Assist endpoint remoteassistance.support.services.microsoft.com, which prevents new sessions; Microsoft notes this also affects its Remote Help product, so alternatives should be planned first.

Did Sophos link STAC4749 to MuddyWater?

No. Although Chaos has appeared as a possible decoy in separate MuddyWater activity reported by others, Sophos found no evidence connecting the STAC4749 cluster to that Iranian group and instead noted limited Russian-keyboard artifacts without firm attribution.