Reported by 2 outlets

Timeline

1. original reporting

   STAC4749: Attackers Use Two-Minute Microsoft Teams Call to Deploy Chaos Ransomware

   cybersecuritynews.com · 76d ago · July 30th, 2026

   A campaign tracked as STAC4749 shows attackers using a surprisingly short attack chain: a two-minute Microsoft Teams call as the initial social engineering vector to deploy Chaos ransomware.

   Attack flow:

   1. Attackers pose as IT support staff and initiate Teams calls to employees

   2. During the call, they persuade employees to grant remote access (via legitimate remote access tools)

   3. Once inside, attackers move laterally across the network using compromised credentials

   4. Chaos ransomware is deployed to encrypt network shares

   Scale: Dozens of North American organizations targeted between February and June 2026. The campaign is notable for its low barrier to entry — no exploit development required, pure social engineering.

   Action: Train employees that legitimate IT support will never request remote access via unsolicited calls. Implement conditional access policies that flag anomalous remote access sessions initiated from non-corporate devices. Monitor for mass file encryption events.

2. update from bleepingcomputer.com

   STAC4749: Microsoft Teams Vishing Campaign Now Confirmed to Deploy Chaos Ransomware — One Attack Encrypted in Under 17 Hours

   bleepingcomputer.com · 75d ago · July 31st, 2026

   First surfaced as a gap Jul 30 via Cyber Security News. New today: BleepingComputer/Sophos reporting confirms ransomware deployment and adds timing data.

   Sophos' full writeup on campaign STAC4749 — attackers impersonating IT support over Microsoft Teams calls to gain remote access and deploy Chaos ransomware — confirms the impact: dozens of North American organizations targeted between February and June 2026, with at least three intrusions leading to Chaos deployment. One attack went from initial access to file encryption in less than 17 hours. Enforce conditional access on remote-access tooling, require second-person approval for new remote sessions, and monitor for mass file-encryption events.