The STAC4749 campaign involves threat actors impersonating IT support personnel in Microsoft Teams calls to socially engineer employees into granting remote access. The attackers use external Teams accounts with IT-themed domains under the ".top" TLD and fake personas. They initially favored Microsoft Quick Assist but shifted to RemSupp for remote management. Once access is gained, PowerShell scripts download backdoors that establish persistence via disguised registry entries mimicking audio drivers. Additional remote access tools like DWAgent or AnyDesk are installed for backup access, and attackers attempt to enable RDP for lateral movement. The campaign evolved its techniques to evade detection between February and May 2026. At least three incidents resulted in Chaos ransomware deployment, with one case encrypting files within 17 hours of initial access. The Chaos ransomware-as-a-service group is linked to former BlackSuit and Royal ransomware gangs, themselves spinoffs of Conti. The campaign primarily targeted organizations in Canada and the US across sectors including services, manufacturing, energy, and construction.

Successful attacks result in unauthorized remote access to corporate devices, enabling attackers to deploy backdoors and establish persistence. This access facilitates lateral movement within networks and the deployment of Chaos ransomware, which encrypts files and threatens data leakage. At least three organizations suffered ransomware attacks, with one incident involving rapid encryption within 17 hours and likely data theft prior to encryption. The campaign disrupts business operations and exposes sensitive data to extortion risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should be aware of this social engineering threat vector via Microsoft Teams and educate employees to verify IT support requests independently. Blocking or monitoring the use of unauthorized remote support tools like RemSupp may reduce risk. Implementing strict application allowlisting and restricting remote access tools can help prevent unauthorized sessions. Since this is a social engineering attack leveraging legitimate collaboration tools, user training and verification processes are critical.