Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
Threat actor
STAC4749
- Mentions · 7d0
- Mentions · 30d1
- All mentions1
- First seenOct 26, 2026
- Last mentioned16d ago
Timeline
1 articles · newest firstAppears with
- ScreenConnectproduct · 1
- Microsoftvendor · 1
- Sophosorganization · 1
- GoGRPCmalware · 1
- AnyDeskproduct · 1
- TeamViewerproduct · 1
- Chaosmalware · 1
- Arctic Wolf Labsorganization · 1
- Microsoft Teamsproduct · 1
- Quick Assistproduct · 1
- Microsoft 365product · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.