Teams vishing to ransomware in 17 hours: lock external chat

Sophos published its analysis of STAC4749 on July 30: a Microsoft Teams vishing campaign that hit dozens of organizations between February and June 2026, ending in Chaos ransomware at least three times. In one case, initial access to encrypted files took under 17 hours. No exploit, no CVE, no patch to apply. Somebody called an employee on Teams, said they were IT, and the employee said yes.

What actually happened

Per Sophos, the attackers worked from external Teams accounts, opening with chats and voice calls while impersonating helpdesk or IT support. Roughly 94% of targets were in Canada (50%) and the US (44%). The industry spread reads like a normal customer list: services 20%, manufacturing 17%, energy 12%, construction and engineering 12%, plus law firms doing IP work.

The chain after the call is mundane, which is the point. Victims were talked into a remote support session — Microsoft Quick Assist early in the campaign, an RMM tool called RemSupp from April onward. From there: PowerShell pulling custom loaders and Python backdoors, persistence via registry Run keys disguised as audio drivers, then Golang implants, DWAgent, AnyDesk, and a custom SOCKS proxy for backup access. When the ransomware fired, encryption hit endpoints nearly simultaneously.

Note what carried the attack: two tools your IT provider legitimately uses, and a Teams call from outside your tenant.

Why Teams vishing matters for your business

Your security spend assumes attacks arrive as email. This one arrives as a chat from a person with a plausible name, inside the app your staff already trust, and it beats every filter you're paying for.

Three controls, none of which need a new vendor. First, open the Teams admin center and look at external access. Most small businesses do not need open federation with every Microsoft tenant on earth — restrict it to an allowlist of domains you actually work with, and shut off unmanaged-account chat. That single setting removes the entry point. Second, put a rule in writing and say it out loud in a staff meeting: IT never initiates a remote session over Teams. Give people one phone number to call back on, and make "I'll verify and call you" a response nobody gets in trouble for. Third, decide whether Quick Assist should run on your machines at all. If your provider uses a different tool, block it.

Then check the boring one. The 17-hour case ended in simultaneous encryption across endpoints — the difference between a bad week and a closed business is whether your backups are offline, restorable, and tested this quarter. Not configured. Tested.

Sources: Sophos, BleepingComputer.