STAC4749 runs Teams helpdesk vishing from attacker-owned .top domains into certificate-pinned Golang implants and Chaos ransomware in under 17 hours
The initial access here is entirely social, and the interesting part is what the operators changed. Contact comes as a Microsoft Teams chat or call from an IT-support persona; Sophos observed call durations from 90 seconds to over 20 minutes, most lasting two to two and a half (Sophos X-Ops, 2026-07-28). Earlier Teams-abuse campaigns spoofed onmicrosoft.com tenants, which gave defenders a tractable check. STAC4749 instead registers its own IT-themed domains under the .top TLD and populates them with plausible first-name/last-name employee accounts (Sophos X-Ops, 2026-07-28). That moves the detection question from "is this tenant genuinely Microsoft's" to "should this external domain be able to reach our users at all" — a policy question rather than a signature one. The persuasion goal is a remote-support session: Quick Assist initially, with the cloud-based RemSupp as fallback, and from April 2026 RemSupp by preference — Sophos assesses this is likely because it is less apt to appear on application blocklists (Sophos X-Ops, 2026-07-28). Lateral movement consistently began by enabling RDP on the initial host through Windows service reconfiguration via msconfig (Sophos X-Ops, 2026-07-28).
Two payload design choices are worth carrying into detection engineering. First, the Python backdoor — PyArmor-obfuscated, PyInstaller-packaged, able to run shell commands, collect system information and load further Python modules — retrieves its AES key and initialisation vector from a public code-hosting repository at runtime and uses them to decrypt its embedded configuration and payload (Sophos X-Ops, 2026-07-28). The key is therefore not in the sample, which defeats static key extraction and lets the operators rotate it by editing a public page. Second, the Golang implants embed CA certificates and will complete an encrypted connection only when the C2 server presents a matching issuer; Sophos found payloads sharing an issuer consistently talked to the same servers while different issuers meant separate infrastructure, and reads this as deliberate segmentation by payload or operational role (Sophos X-Ops, 2026-07-28). The practical effect is that a TLS-terminating proxy or a researcher's redirection attempt cannot complete the handshake, so interception-based analysis and sinkholing both fail unless the issuer is reproduced. Persistence evolved visibly across the campaign: HKCU Run keys masquerading as Realtek audio components from February, joined by WinAudio-themed names from mid-May, alongside .vbs scripts creating Startup-folder shortcuts named to look like SecurityHealth or OneDriveUpdate, sometimes with hidden attributes (Sophos X-Ops, 2026-07-28). In ransomware cases operators added DWAgent and AnyDesk for redundant access, and in one case a standalone reverse-SOCKS proxy supporting up to a thousand concurrent connections; encryption landed nearly simultaneously across endpoints, in one incident under 17 hours from initial access (Sophos X-Ops, 2026-07-28).
Triage: the remote-support tools in this chain are genuine software that IT departments use daily, so the tool itself discriminates nothing — and neither does the fact of an inbound Teams call. The discriminator Sophos's own guidance points at is provenance and initiative: a legitimate support session is requested by the user or arranged against an existing internal ticket, whereas this pattern is an unsolicited approach from an unrecognised external domain followed immediately by pressure to launch or install a remote-access tool. Operationally that means correlating remote-support process starts against your ticketing system, and treating a first-ever external Teams contact followed within minutes by an RMM installation as the sequence to alert on.
STAC4749 operators created IT-themed cloud domains under the ".top" top-level domain (TLD) and leveraged plausible employee usernames to make the accounts appear legitimate
Several of the Golang-based implants contained hard-coded CA certificates associated with issuer names such as loop-CA, connectify-CA, and james-bond-CA. These implants only established encrypted connections if the C2 server had the same issuer as the embedded certificate.
Retrieved its AES key and initialization vector (IV) from a public GitHub repository and used the key to decrypt embedded configuration data and payload
In one incident, the time from initial access to ransomware deployment was less than 17 hours, consistent with prior Chaos ransomware cases observed by Sophos analysts.
Sophos analysts have found no evidence linking STAC4749 activity to that group. Instead, limited hands-on-keyboard artifacts suggest a Russian-language connection.
However, there is insufficient evidence for attribution.
Defender actions
- Restrict Microsoft Teams external access to federated domains you have allow-listed, rather than permitting chats and calls from any external tenant — STAC4749's shift to its own registered .top-TLD domains means tenant-spoofing detections and onmicrosoft.com heuristics will not catch it.
- Add RemSupp to the remote-support tooling your application control blocks or alerts on: Sophos assesses the operators moved to it from Quick Assist specifically because it is less likely to appear on blocklists, so an estate that blocks only the well-known tools has an open path.
ATT&CK mapping
11 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1566.004Phishing: Spearphishing Voice
Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: Impersonation) and/or creating a sense of urgency or alarm for the recipient.
Persistence TA0003
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
T1547.009Boot or Logon Autostart Execution: Shortcut Modification
Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
Privilege Escalation TA0004
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
T1547.009Boot or Logon Autostart Execution: Shortcut Modification
Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.
Stealth TA0005
T1027Obfuscated Files or Information
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Lateral Movement TA0008
T1021.001Remote Services: Remote Desktop Protocol
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
T1090Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
T1105Ingress Tool Transfer
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Impact TA0040
T1486Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.