Hackers abuse Microsoft Teams in ransomware campaign through fake IT support

1. Executive summary

A financially motivated threat group tracked as STAC4749 is conducting vishing attacks via Microsoft Teams, impersonating IT support staff to trick employees at dozens of US and Canadian organisations into granting remote access. The actors use Microsoft Quick Assist or the cloud-based RemSupp tool to initiate remote sessions, then deploy PowerShell for persistence and payload execution. In at least three confirmed cases the attackers deployed Chaos ransomware, with one intrusion progressing from initial access to ransomware deployment in 17 hours. No verified CVSS, CISA-KEV, or MITRE attribution data was resolved for this item; the STAC4749 designation and Chaos RaaS linkage are single-sourced to Sophos. EMEA financial services with North American subsidiaries or shared collaboration tenancies should treat Teams-based social engineering as an active initial-access vector.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	The 17-hour initial-access-to-ransomware timeline demonstrates a need for pre-defined detection and response procedures for social-engineering-driven ICT incidents via collaboration platforms.	Clients must ensure their incident management process covers vishing/remote-assist abuse scenarios, not just traditional network-border events.
DORA Art. 24: digital operational resilience testing — general requirements	The abuse of legitimate Microsoft Teams and Quick Assist pathways bypasses traditional email-security controls, implicating the adequacy of current resilience testing scope.	Resilience testing programmes should include simulation of collaboration-platform social engineering and remote-assist abuse.

No specific NIS2 or UK NIS article is directly engaged beyond generic incident-response obligations, which apply to virtually any incident and are not item-specific here.

3. Technical analysis & attack chain

Attribution caveat: STAC4749 is tracked by Sophos. No MITRE ATT&CK profile was resolved in the verified reference data for this item; attribution to STAC4749 and the assessment of financial (vs. state-sponsored) motivation are single-sourced to Sophos. Sophos explored possible links to Iran-linked MuddyWater (following a Rapid7 report on MuddyWater false-flag activity) but concluded the activity is most consistent with a cybercriminal operation. This attribution is unconfirmed pending independent corroboration.

Attack chain (confirmed steps from source material)

Initial contact via Microsoft Teams. Attackers initiate unsolicited Teams chats or voice calls to employees, posing as corporate IT support or help desk staff. Targeted sectors include services, manufacturing, energy, construction, and engineering. Campaign activity observed from February through June 2026.
Remote session establishment. Attackers persuade the employee to grant remote access via Microsoft Quick Assist or the cloud-based RemSupp tool. Prior Chaos-linked campaigns have also used DWAgent and AnyDesk for lateral movement.
PowerShell execution. Once remote access is established, attackers deploy PowerShell to establish persistence and execute malicious payloads. Specific persistence mechanisms, registry keys, or scheduled tasks are not detailed in the available source material.
Payload deployment. In at least three confirmed cases, attackers deployed Chaos ransomware. Chaos RaaS has been active since February 2025 and is linked to former members of BlackSuit ransomware (Sophos reporting).
Data theft and extortion. Data was stolen in a subset of intrusions. The attacks are consistent with double-extortion operations that prioritise speed. Sophos did not observe behaviour typical of espionage-focused actors (long-term persistence, covert access, targeted intelligence collection).
Timeline. In one observed case, the time from initial access to ransomware deployment was 17 hours, consistent with prior Chaos cases.

BleepingComputer independently reports Microsoft Teams vishing leading to Chaos ransomware, and separately reports EtherRAT malware pushed via fake Teams IT-support calls.
SecurityWeek reports a separate but related pattern: DragonForce ransomware abusing Microsoft Teams relay servers for C2, including a Go-based backdoor using Teams servers for command-and-control.
Unit 42 has published general guidance on attackers targeting collaboration platforms including Teams.
Help Net Security reports a parallel phishing shift (Check Point): attackers abusing Microsoft's own authentication system rather than fake login pages, using Microsoft Planner task-assignment notification lures. This is a distinct campaign (June 25 – mid-July, 200+ phishing emails, ~120 organisations) but reflects the same broader trend of abusing legitimate Microsoft services.

What is NOT in the source material: No specific CVEs, file hashes, domain/IP indicators, mutex names, ransom-note text, exact PowerShell commands, registry keys, or file paths were provided. No CISA-KEV entries are associated. No CVSS scores apply.

4. Mitigation & containment

P1 — Within 24 hours

Restrict external Teams communication. Configure Teams admin centre to limit or block external (federated) chat and call initiation for non-whitelisted domains. If external federation is not a business requirement, disable it tenant-wide.
Alert on Quick Assist and RemSupp usage. Deploy EDR or process-monitoring rules to flag execution of quickassist.exe and any RemSupp process, especially when initiated shortly after a Teams call/chat session from an external or unknown contact.
Block or monitor remote-support tools. If DWAgent, AnyDesk, or RemSupp are not approved IT tools, block their execution via application control / EDR blocking rules. If they are approved, restrict to specific service accounts and alert on use outside change-management windows.
User advisory. Issue an immediate awareness bulletin to all staff: legitimate IT support will never initiate unsolicited Teams calls requesting remote access. Instruct employees to verify any IT-support request via a known internal phone number or ticketing system before granting remote access.

P2 — Within 72 hours

Review Teams external-access policies. Audit Teams admin settings for external access and guest access. Ensure only explicitly approved domains are federated.
Deploy or tune detection for PowerShell launched from remote-support contexts. Create EDR correlation rules: remote-support tool process → child PowerShell process → alert. Flag PowerShell execution with -ExecutionPolicy Bypass or -WindowStyle Hidden launched under user sessions that also have Teams active.
Hunt for prior compromise. Search endpoint logs for Quick Assist / RemSupp / DWAgent / AnyDesk execution over the past 120 days (covering the February–June campaign window). Correlate with subsequent PowerShell activity and any evidence of data staging or exfiltration.
Validate incident response runbooks. Ensure playbooks cover vishing-initiated compromise via collaboration tools, including rapid isolation of endpoints where unauthorised remote sessions were granted.

P3 — Within 7 days

Conduct a tabletop exercise simulating a Teams-based vishing → remote-assist → ransomware scenario, timed against the 17-hour observed dwell time to test detection and containment speed.
Review conditional access policies for Microsoft Teams and Quick Assist. Enforce MFA, session risk policies, and device-compliance requirements.
Engage third-party risk review if any managed-service providers use Teams or remote-support tools to access client environments — verify their social-engineering controls and remote-session verification procedures.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, file paths) are available in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
Unsolicited Microsoft Teams chat or call from external/unknown contact claiming to be IT support	Teams admin logs, Microsoft 365 audit logs	High — corroborated across Sophos, BleepingComputer, Unit 42
Execution of Microsoft Quick Assist (`quickassist.exe`) or RemSupp initiated by end user (not via IT ticket)	EDR process logs, endpoint event logs	High — confirmed in Sophos report
PowerShell execution as child process of remote-support tool session	EDR process-tree correlation	Medium — Sophos confirms PowerShell use; specific parent-child relationship inferred from attack chain
Rapid progression from remote session to ransomware deployment (~17 hours)	EDR timeline, SIEM correlation	Medium — single case observed by Sophos
Data exfiltration prior to ransomware deployment (double extortion)	Network egress monitoring, DLP	Medium — observed in subset of intrusions
Use of DWAgent or AnyDesk for lateral movement	EDR, application logs	Low — attributed to prior Chaos campaigns, not necessarily this STAC4749 wave

6. Detection

Insufficient atomic indicators to author YARA rules. However, the source material provides enough behavioural signal for Sigma rules targeting the process-level attack chain.

title: Remote Support Tool Followed by PowerShell Execution
id: AT-2026-07-30-439-001
status: experimental
description: >
  Detects PowerShell execution shortly after a remote support tool
  (Quick Assist, RemSupp, AnyDesk, DWAgent) is launched, consistent
  with STAC4749 / Chaos ransomware vishing attack chain.
author: Adverse Trace
date: 2026/07/30
references:

  - https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/
logsource:
  product: windows
  category: process_creation
detection:
  remote_support:
    Image|endswith:

      - '\quickassist.exe'
      - '\remsupp.exe'
      - '\anydesk.exe'
      - '\dwagent.exe'
  powershell_child:
    Image|endswith:

      - '\powershell.exe'
      - '\pwsh.exe'
  selection:
    ParentImage|endswith:

      - '\quickassist.exe'
      - '\remsupp.exe'
      - '\anydesk.exe'
      - '\dwagent.exe'
    Image|endswith:

      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:

  - Legitimate IT support sessions using approved remote tools followed by PowerShell administration
level: high

title: Microsoft Teams Process Active During Remote Support Tool Launch
id: AT-2026-07-30-439-002
status: experimental
description: >
  Detects remote support tool execution while Microsoft Teams is
  active on the same endpoint, consistent with vishing attack pattern
  where attacker initiates Teams call then guides user to grant remote access.
author: Adverse Trace
date: 2026/07/30
references:

  - https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/
  - https://unit42.paloaltonetworks.com/microsoft-teams-phishing/
logsource:
  product: windows
  category: process_creation
detection:
  teams_active:
    Image|endswith:

      - '\ms-teams.exe'
      - '\msteams.exe'
  remote_tool:
    Image|endswith:

      - '\quickassist.exe'
      - '\remsupp.exe'
  condition: remote_tool
falsepositives:

  - Legitimate IT support sessions initiated through Teams by approved help desk staff
level: medium

7. Sources

Cybersecurity Dive — "Hackers abuse Microsoft Teams in ransomware campaign through fake IT support" — https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/ — 2026-07-30
BleepingComputer — "Microsoft Teams vishing attacks lead to Chaos ransomware attacks" — https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/
BleepingComputer — "Fake IT support calls on Microsoft Teams push EtherRAT malware" — https://www.bleepingcomputer.com/news/security/fake-it-support-calls-on-microsoft-teams-push-etherrat-malware/
SecurityWeek — "Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack" — https://www.securityweek.com/microsoft-teams-relay-servers-abused-in-dragonforce-ransomware-attack/
Palo Alto Unit 42 — "When 'Hi, This Is IT' Comes Through Microsoft Teams" — https://unit42.paloaltonetworks.com/microsoft-teams-phishing/
Help Net Security — "Attackers are using Microsoft's legitimate login system to camouflage phishing attacks" — https://www.helpnetsecurity.com/2026/07/30/microsoft-authentication-system-phishing/ — 2026-07-30

8. Adverse Trace position

This is a high-impact social-engineering campaign abusing legitimate collaboration and remote-support infrastructure — precisely the category of threat that bypasses email-security and endpoint-hardening investments. The 17-hour dwell time from initial access to ransomware deployment leaves a narrow but viable detection window if clients instrument the remote-support-tool-to-PowerShell execution chain. The STAC4749 attribution and Chaos RaaS linkage are single-sourced to Sophos; we treat them as credible but unconfirmed pending independent corroboration. The broader pattern — Teams vishing, Quick Assist abuse, EtherRAT delivery, DragonForce C2 via Teams relay — is corroborated across at least four independent sources and indicates a systemic weakness in how organisations monitor collaboration-platform abuse. We will continue tracking for atomic IOCs from Sophos's full report and will update this advisory if indicators become available. EMEA financial services clients with Microsoft Teams tenants open to external federation should treat external-access restriction as the highest-priority immediate action.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.