bleeping-computer Jul 30, 2026 · Crawled Jul 30, 2026

Microsoft Teams vishing attacks lead to Chaos ransomware attacks

6 IoCs 1 Actors 1 Malware

AI Summary

Threat actors are conducting vishing attacks via Microsoft Teams, impersonating IT support staff to trick employees into granting remote access to corporate devices. These intrusions are part of campaign STAC4749, tracked by Sophos, which led to the deployment of Chaos ransomware in at least three organizations. The attackers used fake IT-themed domains and spoofed identities to initiate contact, then deployed remote management tools like RemSupp and PowerShell-based backdoors to establish persistence and move laterally. The campaign targeted primarily North American organizations, with attacks spanning from February to June 2026, and demonstrated rapid progression from initial access to ransomware encryption—sometimes within 17 hours.

AI-extracted · verify before operational use

Extracted Entities 2 found

Malware Royal Ransom (ELF) → Threat Actor MuddyWater →

Indicators of Compromise 6 extracted

Type	Value	Detail
Domain	sequrityupdate[.]top	Details →
Domain	scan-security[.]top	Details →
Domain	system-connect[.]top	Details →
Domain	corp-connect[.]top	Details →
Domain	supportsoft[.]top	Details →
Filename	readme.chaos.txt	Details →

MITRE ATT&CK TTPs 21 techniques

T1021.001 Remote Desktop Protocol · Lateral Movement T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1204.002 Malicious File · Execution T1486 Data Encrypted for Impact · Impact T1543.003 Windows Service · Persistence T1566.002 Spearphishing Link · Initial Access T1003 OS Credential Dumping · Credential Access T1027 Obfuscated Files or Information · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.007 JavaScript · Execution T1074 Data Staged · Collection T1074.001 Local Data Staging · Collection T1082 System Information Discovery · Discovery T1090.003 Multi-hop Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1219 Remote Access Software · Command And Control T1566 Phishing · Initial Access T1573.001 Symmetric Cryptography · Command And Control T1588 Obtain Capabilities · Resource Development