STAC4749

STAC4749 is a financially motivated cybercriminal activity cluster tracked by Sophos and associated with intrusions culminating in Chaos ransomware deployment. Between February and June 2026, it targeted dozens of organizations, predominantly in Canada and the United States. Targeted sectors included manufacturing, energy, construction and engineering, and professional services, including intellectual property law firms. The operators obtain initial access through Microsoft Teams chats and voice calls, impersonating internal helpdesk personnel using plausible employee identities and IT-themed domains. Victims are persuaded to authorize remote sessions through Microsoft Quick Assist or RemSupp. Following access, the attackers use PowerShell to deliver malware, collect host information, identify security products, and establish persistence. Their modular toolkit includes a custom loader, a PyArmor-protected Python backdoor packaged with PyInstaller, and Golang implants. Persistence mechanisms include registry Run keys and Startup-folder shortcuts masquerading as legitimate audio or system components. STAC4749 establishes redundant access through tools such as DWAgent and AnyDesk, attempts to enable Remote Desktop Protocol, and uses reverse SOCKS proxies to reach internal systems. The operators repeatedly modify payload names, deployment methods, and persistence mechanisms to evade detection; DLL sideloading was also observed. At least three attributed intrusions resulted in Chaos ransomware deployment, including one that progressed from initial contact to encryption in less than 17 hours. Data exfiltration has also been observed. Its precise organizational relationship with the Chaos ransomware-as-a-service operation is not established, and its country of origin remains unknown.