Key Takeaways

  • STAC4749 attackers pose as IT support through Microsoft Teams external chat before requesting remote access.
  • Quick Assist, AnyDesk and Atera can give attackers an authorized-looking path into enterprise environments.
  • External chat restrictions, independent verification and segmented access can reduce the campaign’s reach.

Aviatrix Threat Research has documented a 2026 STAC4749 campaign that turns familiar workplace support interactions into an entry point for ransomware. The attackers impersonate IT personnel through Microsoft Teams external chat, combine email bombing with voice phishing, and persuade employees to grant remote access.

The sequence is effective because much of it resembles legitimate support activity. An employee receives a flood of unwanted email, then a helpful person appears in Teams or calls with an explanation. The supposed technician offers to resolve the disruption using Microsoft Quick Assist, AnyDesk or Atera. Once the employee authorizes the connection, the attacker has crossed the perimeter with the user’s cooperation rather than through a conventional software exploit.

From there, the activity becomes more recognizably malicious. Aviatrix reports that the attackers perform Active Directory reconnaissance, deploy the GoGRPC backdoor and move toward Chaos ransomware. At least three cases observed in 2026 progressed from Teams-based social engineering to Chaos deployment. In one case, full encryption occurred in under 17 hours.

That speed changes the defensive calculation. A suspicious chat message cannot sit in a review queue for a day while security teams determine whether it is genuine. By then, identity discovery, privilege escalation and lateral movement may already be underway.

The approach succeeds by exploiting trusted channels simultaneously. Microsoft Teams is an accepted business platform, and remote-management products are routinely used by real support teams. Attackers combine email bombing to create pressure with voice contact to add apparent credibility, forming a tightly managed social-engineering chain.

Legitimate administration tools can be especially useful to intruders because their presence does not automatically indicate malware. Quick Assist, AnyDesk and Atera have valid business purposes. When a user has approved a session, some security controls may initially interpret the resulting activity as authorized support rather than hostile access.

The campaign operates within a much larger fraud economy. CyberScoop reported that FBI data showed more than $2.1 billion in reported U.S. losses from tech-support scams during 2025. The FBI also received more than 3,600 ransomware complaints. Security Point Break similarly highlighted fraud, rather than purely technical intrusion, as a major driver of 2025 cybercrime losses.

For enterprises, blocking a particular ransomware payload addresses only the end of this chain. Earlier intervention points offer more leverage. Organizations can restrict Microsoft Teams external communication to approved domains or business groups, while monitoring newly initiated chats that claim to come from internal support.

Help-desk verification also requires attention. Employees need a known, separate channel for confirming unexpected support requests, such as an internal service portal or published phone number. A callback through the same Teams conversation is not independent verification; this distinction determines whether the control actually works.

Security teams can maintain an approved list of RMM products, prevent the installation or execution of unsanctioned alternatives, and alert when approved tools appear on devices or accounts that do not normally use them. Short-lived support access, device-health checks and phishing-resistant multifactor authentication further constrain compromised sessions.

Network segmentation limits the potential damage. If one authorized remote session exposes broad identity infrastructure or privileged systems, the ransomware blast radius remains large. Least-privilege access, separate administrative accounts and network controls around critical assets make reconnaissance and lateral movement slower and more visible.

The campaign illustrates a practical application for Zero Trust architecture: a familiar application, authenticated user and approved remote tool are not sufficient evidence that an interaction is safe. Defenses must verify the person, device, purpose and requested privilege at each stage, especially when attackers rely on exploiting human authorization.