Loading story…
Sophos reported that 3AM ransomware operators combined telephone-based social engineering with Microsoft Quick Assist to gain remote access to a target environment, then introduced a virtual machine into the victim network as part of the intrusion. The activity followed a familiar ransomware playbook built around user deception and remote administration, but the use of a dropped VM added a notable twist that helped the attackers operate inside the compromised environment.
The incident highlights how ransomware crews are continuing to blend vishing, legitimate remote-support tools, and virtualization to advance attacks while reducing the need for custom malware early in the intrusion. By leveraging trusted software and a VM-based foothold, the 3AM actors were able to progress from initial access toward ransomware deployment using techniques that can be harder for defenders to distinguish from normal administrative activity.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos released a report describing a 3AM ransomware intrusion that used vishing, Quick Assist, and a dropped virtual machine as part of the attack chain. The provided reference does not include underlying incident dates, so the publication date is used as the event date.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and Sophos reported separate but closely aligned social-engineering campaigns in which attackers impersonated IT support staff over Microsoft Teams, phone calls, and related pretexts to trick employees into granting remote access through **Quick Assist** or other support tools. Microsoft attributed its activity to **Storm-1811**, which used vishing and email-bombing to gain access, steal credentials through **EvilProxy**, and deploy tools including **Qakbot**, **Cobalt Strike**, **ScreenConnect**, **NetSupport Manager**, **OpenSSH** tunneling, and **SystemBC** before rolling out **Black Basta** ransomware with **PsExec**. Microsoft said it suspended malicious Teams accounts and tenants involved in the impersonation activity and added stronger Quick Assist warnings and trust indicators.
Aug 14, 2026
Sophos MDR reported two ransomware campaigns that combined **email bombing** with **voice phishing over Microsoft Teams** to gain initial access to targeted organizations. In the observed intrusions, attackers overwhelmed users with large volumes of emails and then contacted them through Teams while impersonating IT or help desk staff, using the confusion to persuade victims to grant remote access or follow attacker-directed steps. The activity highlights how adversaries are blending social engineering with trusted enterprise collaboration tools to bypass technical defenses. The campaigns were tied to ransomware operations and show a repeatable intrusion pattern in which attackers exploit user fatigue, trust in internal support workflows, and the widespread use of Microsoft 365 services. The reported tradecraft underscores the need for organizations to harden Teams and remote-support processes, verify help desk interactions through separate channels, and train staff to treat unsolicited support calls during email floods as suspicious, especially when they involve requests for remote access, credential entry, or security tool changes.
Jul 12, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026