Hackers abuse Microsoft Teams in ransomware campaign through fake IT support

BLUF

STAC4749 targeted dozens of North American firms, gaining remote access through Quick Assist or RemSupp before executing PowerShell payloads. In one intrusion, Chaos malware was deployed within 17 hours, demonstrating rapid double-extortion tactics.

Learning Outcomes

• Assess social engineering techniques enabling unauthorised remote access.
• Evaluate indicators distinguishing cybercrime from state-sponsored espionage.