When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware
Beginning in 2026, threat actors exploiting Microsoft Teams' external chat feature launched a sophisticated social engineering campaign impersonating IT support personnel to deliver malware and ransomware across hundreds of organizations. Attackers established fraudulent Microsoft 365 tenants using IT-themed onmicrosoft.com and paid top-level domains, preceded attacks with email bombing to create urgency, then used vishing to gain remote access via tools such as AnyDesk, Quick Assist, and Atera. Once inside, they conducted Active Directory reconnaissance via LDAP queries, deployed the GoGRPC backdoor, moved laterally to domain controllers, and dropped Chaos ransomware while exfiltrating sensitive data. This campaign underscores a critical shift in attacker tradecraft: rather than exploiting software vulnerabilities, adversaries are weaponizing trusted collaboration platforms and legitimate remote management tools. The STAC4749 threat cluster's repeated use of this pattern—across cloud tenants, RMM tooling, and ransomware payloads—signals a durable, scalable playbook that security teams must treat as an ongoing threat to enterprise communication infrastructure.
Kill Chain
