STAC5777

STAC5777 is a financially motivated intrusion cluster associated with Microsoft Teams and Quick Assist social-engineering campaigns that overlap with Microsoft’s Storm-1811 tracking. The actor has been linked to ransomware and data-theft extortion activity and has operational ties to ecosystems associated with Black Basta and 3AM. Its tradecraft centers on email bombing followed by impersonation of internal IT or help-desk staff over Microsoft Teams, persuading victims to grant remote access or install remote-support tooling. After initial access, the actor has deployed malware through DLL sideloading using a legitimate Microsoft-signed executable to load a malicious winhttp.dll, established persistence through services and startup shortcuts, and stored command-and-control configuration in the registry. Observed post-compromise behavior includes hands-on-keyboard activity, system and network discovery, credential theft, keylogging, scanning for SMB, RDP, and WinRM targets, lateral movement using compromised credentials, VPN access, RDP, and WinRM, and attempts to weaken defenses by uninstalling multifactor-authentication components or endpoint protection. The actor has also searched for password-related files and network diagrams to support further movement and access expansion. In at least one observed intrusion, the cluster attempted to deploy Black Basta ransomware, and reporting has assessed the broader campaign pattern as part of ransomware and data-theft extortion operations. STAC5777 is distinct from STAC5143, another cluster using a similar Teams-vishing playbook, but STAC5777 is characterized by heavier direct operator interaction and scripted command execution. Known aliases and related designations include STAC5777, STAC5777 (suspected early phase alignment), and Storm-1811.