Cybersecurity researchers have flagged a fairly clever — and fairly alarming — extortion campaign where attackers are using Microsoft Teams voice calls to worm their way into corporate networks and drop Chaos ransomware. Security firm Sophos, which is tracking the group as STAC4749, found that this financially driven operation hit dozens of organisations across North America between February and June 2026. The trick? Pretending to be internal IT support, convincing employees to hand over remote access, and then moving fast — really fast — to escalate privileges, steal data, and deploy ransomware, all within hours.
How the Social Engineering Actually Works
The entire attack hinges on building trust through direct conversation on Microsoft Teams. The attackers pose as helpdesk staff, calling employees about made-up technical issues or "urgent" security updates. To make things look legitimate, they register IT-sounding domains under the .top extension and build convincing fake accounts with realistic enterprise-style usernames. Some of these calls lasted barely 90 seconds; others stretched past 20 minutes, depending on how much convincing was needed.
Once an employee is hooked, the caller walks them through installing legitimate remote access software. Early on, the group leaned on Microsoft Quick Assist, but later shifted to third-party tools like RemSupp, AnyDesk, and DWAgent. This is actually the smart part of their strategy — by using real, trusted software instead of custom malware, they slip right past security tools that are usually watching for suspicious, unverified programs.
What Happens After They're In
Once the attackers get remote control of a victim's machine, they run PowerShell commands to lock in persistent access and scope out the system. They quietly plant custom loaders and Python-based backdoors in hidden folders like AppData\Roaming, and to make sure they survive a reboot, they add registry Run keys and Startup folder scripts — often disguised under harmless-sounding names like "Realtek" or "WinAudio" so nothing looks out of place.
For communicating back to their command servers, the malware uses gRPC protocols and Golang-based payloads, authenticated through unique tokens. They even use hardcoded digital certificates to pin their connections, making the malicious traffic blend right in with regular encrypted business communication. Before making any big moves, the attackers quietly gather details about the system — OS version, machine ID, security software in place, user privileges — and then try to enable RDP to spread further across the network.
Fast, Targeted, and Highly Calculated
What really stands out here is the speed. In some cases, researchers observed the entire attack — from that first phone call to full ransomware deployment — wrapping up in under 17 hours. Before locking up files, the group typically steals valuable company data and documents, uploading it to cloud storage first, so they've got extra leverage (steal now, encrypt later, extort twice). Once they're ready, they deploy the Chaos ransomware, encrypting files and leaving behind a ransom note called readme.chaos.txt scattered across folders.
Looking at who's being hit, Canada accounts for about 50% of targets and the US around 44%. The hardest-hit sectors include professional services (20%), manufacturing (17%), and energy and construction (12% each). Interestingly, every single legal firm targeted in this campaign specialised in intellectual property law — which suggests this wasn't random. The attackers appear to be deliberately going after organisations sitting on valuable, confidential proprietary information.
What Organisations Can Do About It
Given how effectively collaboration platforms are being weaponised here, security experts are urging companies to tighten their Microsoft 365 settings — specifically, restricting external domains from being able to initiate unsolicited Teams calls or chats with staff. Beyond that, the advice is fairly standard but important: block unauthorised remote access tools through application control policies, keep a close eye on PowerShell execution logs for anything unusual, and regularly check startup registry keys for hidden persistence tricks like the ones used in this campaign..