STAC4749

STAC4749 is a financially motivated activity cluster reported by Sophos in July 2026, observed between February and June 2026 against dozens of organizations, nearly 95% of them in Canada and the U.S. Operators contact victims through Microsoft Teams chats and calls impersonating IT support, using plausible employee usernames on IT-themed '.top' cloud domains rather than onmicrosoft.com tenants, and obtain a remote session through Microsoft Quick Assist or, increasingly from April 2026, the RemSupp RMM tool; RDP is then enabled for lateral movement. PowerShell retrieves a loader communicating over gRPC with hard-coded C2 addresses and checking for an appscreen.log file, later replaced by a PyArmour-obfuscated PyInstaller backdoor that fetches its AES key from a public GitHub repository and talks to workers.dev infrastructure, followed by Golang implants launched with a '--token-raw' argument and pinning embedded CA certificates (issuers such as loop-CA, connectify-CA, james-bond-CA), plus a reverse SOCKS proxy. Persistence relies on HKCU Run keys masquerading as Realtek or WinAudio components and hidden Startup shortcuts; DWAgent and AnyDesk provide redundant access. At least three intrusions ended in Chaos ransomware deployment (the RaaS reportedly launched by former BlackSuit members, not the Chaos builder lineage), in one case under 17 hours after initial access. Sophos notes a Russian-keyboard typo in operator commands, found no evidence of a link to MuddyWater, and state

Recent activity

No posts or advisories have named this actor recently.

References

• https://www.sophos.com/en-us/blog/chaos-in-teams-vishing
• https://arcticwolf.com/resources/blog/threat-actors-abuse-microsoft-teams-external-chat-for-initial-access/
• https://thehackernews.com/2026/10/attackers-use-microsoft-teams-it.html

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.