Executive Summary
A recurring social engineering campaign attributed to STAC4749 is targeting organizations by exploiting Microsoft Teams' external access features. The attack begins with a 'mail bomb' of newsletter subscriptions to create urgency, followed by a Teams message from a fake 'IT Support (Internal)' account. The attackers use throwaway Microsoft 365 tenants, often ending in *.onmicrosoft.com or .top domains, to build trust and bypass traditional email security layers.
Once trust is established, the adversary lures employees into a remote session using legitimate Remote Monitoring and Management (RMM) tools like Quick Assist or AnyDesk. This hands-on-keyboard access is used for reconnaissance, credential theft, and lateral movement toward domain controllers. The campaign has been observed deploying the GoGRPC backdoor and ultimately Chaos ransomware after exfiltrating sensitive data.
This activity highlights a significant shift in initial access tradecraft, where attackers avoid malicious URLs in chat messages to bypass automated scanning (Safe Links/ZAP). Instead, they leverage the inherent trust users place in collaboration platforms and the abuse of legitimate administrative software. Organizations allowing open external federation in Teams are at high risk.