Actor Profile

Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible employee usernames. Motivation appears to be financially driven, targeting organizations with external Teams access enabled to deploy ransomware (including Chaos ransomware) and exfiltrate sensitive data. Actors demonstrate operational maturity through consistent infrastructure patterns, use of throwaway Microsoft 365 tenants, and multi-stage attack chains combining vishing with remote access tool abuse.

TTPs (Tactics, Techniques, Procedures)

Initial access via social engineering through Microsoft Teams external chat feature (T1566 - Phishing), preceded by email bombing to create urgency. Actors impersonate IT support personnel using throwaway Microsoft 365 tenants with IT-themed display names. Employ vishing (T1598.003) to convince victims to install legitimate RMM tools (Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn). Execute PowerShell commands (T1059.001) to download MSI installers from Azure Blob Storage containing Python implants. Conduct Active Directory reconnaissance via LDAP queries (T1087.002 - Domain Account Discovery). Establish persistence through multiple RMM tools like Level for redundancy. Perform lateral movement to domain controllers (T1021), exfiltrate data (T1041), and deploy ransomware including Chaos variant (T1486 - Data Encrypted for Impact). Attackers avoid direct URL pasting in Teams to evade Safe Links/ZAP scanning.

Targets & Patterns

Campaign targets organizations across multiple sectors where Microsoft Teams external access is enabled. No specific geographic or industry focus identified, suggesting opportunistic targeting based on configuration vulnerability rather than strategic selection. Approximately 30-40% of incidents involve use of *.onmicrosoft.com domains, with recent shift toward paid TLDs (50% .top, 40% .com, 5% multi-level domains like .com.pl, .com.vn, .com.br). Attackers increasingly customize display names to include target organization's domain or company name, indicating reconnaissance and tailored social engineering. Pattern suggests actors seek organizations with weaker security awareness training and permissive external collaboration settings.

Historical Context

Activity aligns with STAC4749, previously tracked for creating IT-themed cloud domains under ".top" TLD. Sophos reporting links this campaign pattern to Chaos ransomware deployment. Arctic Wolf Labs identifies this as a "recurring social engineering pattern" observed across hundreds of cases, indicating sustained campaign activity rather than isolated incidents. Recent evolution shows shift from exclusive use of onmicrosoft.com domains to paid TLDs, and addition of target-specific branding in display names, demonstrating tactical adaptation. The mail bombing precursor technique has been observed in many previous cases, suggesting established playbook refinement over time.

Defensive Recommendations

  • Restrict Microsoft Teams external access to trusted domains only, or disable external chat feature entirely if not business-critical
  • Implement email filtering rules to detect and quarantine mail bombing patterns (high volume of subscription confirmations in short timeframe)
  • Deploy endpoint detection rules for legitimate RMM tool execution (Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, LogMeIn, Level) from unexpected processes or user contexts
  • Monitor for PowerShell execution (T1059.001) downloading content from cloud storage services, particularly Azure Blob Storage, via Sysmon Event ID 1 and network telemetry
  • Detect LDAP queries enumerating all AD computer and user objects (T1087.002) from non-administrative endpoints using Windows Event ID 4662 and directory service access auditing
  • Conduct user awareness training specifically on Teams external chat warnings, IT support verification procedures, and vishing tactics involving urgency creation through email flooding