Chaos in Teams Vishing

    Thursday, July 30, 2026 In: Threat Research Print

    Date: 07/30/2026

    Severity: Critical

    Summary

    Threat actor STAC4749 conducted a Microsoft Teams voice phishing (vishing) campaign targeting North American organizations, impersonating IT support to gain remote access. After initial compromise, the attackers deployed a custom loader, backdoor, and modular post-exploitation tools to maintain persistence, enabling data exfiltration and the deployment of Chaos ransomware. The campaign reflects the growing adoption of Teams vishing as a reliable initial access technique for financially motivated ransomware operations. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    stats09.filldowl.online

    de3.filedwnld.top

    dl2.filesdwnl.top

    fa4.fldwnld.online

    fa2.filesdwnload.top

    fa5.flsdwnld.online

    re1.filesdwnld.top

    re2.filesdwnload.top

    re4.fldwnld.online

    re5.flsdwnld.online

    re8.dowlfles.online

    re19.downlf.online

    fa16.dwlfils.online

    re20.downlfl.online

    fa103.aohoodie.com

    re103.aohoodie.com

    re104.artcnb.com

    conf.grahql.workers.dev

    webconf.shop-api.workers.dev

    api.grahql.workers.dev

    imarketads.com

    legio.name

    jrown.fun

    https://de3.filedwnld.top/lwfdei/copyq-13.0.0.zip

    https://fa2.filesdwnload.top/spdnsq/updater.exe

    https://re5.flsdwnld.online/2/download/link

    https://fa16.dwlfils.online/f16mqm/msupdate.exe

    https://fa103.aohoodie.com/olhsek/autumn.exe

    https://fa3.filesdownld.top/ysosje/left.exe

    https://fa4.fldwnld.online/f4yxje/nation.exe

    https://fa2.filesdwnload.top/spdnsq/graph.exe

    https://fa4.fldwnld.online/f4yxje/tube.exe

    https://fa5.flsdwnld.online/f5yxog/WiSec.exe

    https://fa5.flsdwnld.online/f5yxog/agree.exe

    https://fa5.flsdwnld.online/f5yxog/hire.exe

    https://fa5.flsdwnld.online/f5yxog/dizzy.exe

    https://fa5.flsdwnld.online/f5yxog/confirm.exe

    https://fa5.flsdwnld.online/f5yxog/sc5.exe

    IP Address

    93.88.205.136

    5.8.18.80

    2.58.14.254

    94.140.114.192

    94.140.115.18

    94.140.115.129

    208.91.112.55

    193.29.57.37

    195.133.38.33

    95.81.118.189

    130.49.214.20

    2.58.15.231

    Hash

    a2c6b58d1255b26af6194c7b0270371d91abc21d

    36e80c375861d3ff0a55d5e49c8fe12e

    9ea9f3efa1b594fc1ac4bc9dc75ac0f169d606ee1a4c6088b2b7432134643ea

    4081f516e63d5daeec06c855fe5e7dd1953f62fd

    393bb7b8df42079529858fa83178d769

    bb96d21b7a61628724f13c6d4506b9d7bb56020d1c41fc79310f74666bb75904

    51c762e7387aad3e12219c72919e3d3aafb143fc

    3ae5ecc256090a896e7cd8c877f83c1b

    35a75212862ce719ae6de1758949be33a3de787fab31e2d98436bacce8369d92

    23cb533bc3a5b535c06c8f0865e6cdebf442d56a7ac275baddcb9785279e4b88

    f0eb24f7cb4fc861ad19007accd69868eb46111d

    718030cf248b7d25dbc5a3e5a37440f9

    44f8bd68487d0c40227ed44321cf16fc4a34d645252e98d6ba3f81e9f05e7900

    d5572db12b800e87f986ef1138690ec5e17dfa5a0720dc75d453233ada88ee6d

    cd8515405738024b3c7a537901bf6712489b8739

    5658b64ebf3adc94f1ca13f802ec2f26

    2d8ea8fb20f1311e04ea88baa7cff957f6cb73899a524dc2bd39523e14ab022f

    ca304f45a6379a1411435186594a7297fbaf247d

    cce89a06b51d653f487dc7894dfa80e5

    1cf3131b6f487067b3746dd4743544fbbfa553fb2941176b8213996aac61425c

    46cbc561992ba98851700d87c4f8867985b2d0f4

    c19d914dc36ad6cff35c29d00e255223

    746a693e2ba1bb50b941a6ea30026cce02ab9b64ffb9fa6168a62f7aa9557f0a

    94b66ac8391ca543b0dffde6a2d475d29afce6fe32995eda76d379553da68407

    42803189646f339852174bb03189c2d1ce648203

    bc2b16989ae37c6e863439e8f329d23e

    9faa993d608c09eed5dcc9c945b8dd07431fcc192f0232ef379293622a1f3586

    29429aea8f9d7b281494a42c3b107c8358320d44

    2739dfad139f9e44a88b7fcc4749ddbb

    c2fa32ac59f6424657a8513a7f158082877b97436b8502c3879f5736713e2132

    a0063a9dfb75690beadbe4584cedf27d85186dc1

    566fab5cd3596ebeceecd7decd3496a9

    3f0dbc159dcdfb884ebc577dfe873d468617bf5a483bf832469cd209efbe84d4

    da2e2d910307d03164c3a1742e92a7c0d090c374

    547bb05579fa34992289014088967e20

    95fcab7e8892cb87bcadb523a4491bf10ee0788b859647ca7cca1e1d92d7519a

    c0a125258ef094c56ed3ad19b09c7b685fb042c6

    1e3f6f093042fb880417bdca6cb59f11

    219aa20e572dee9d1ef47ae1c33a851fc4fcecc5a45d15ce80c863da67cfeb10

    b99a884dee5a21eaad57048d581cd14ad8862924

    a739bf9634e7094b69ecc286a629cf3c

    65060c1d1c6020ac445ea7b394ef9b1bd9aa23f27d9a508470403c7296924ce8

    6717b8d7be18ea5cdb5944c5b259e022496c6485

    5bd635a72d6f89af394d98e025939eb6

    cd3163a308ba40c3a5e153c0326b7cf23a36debb6255624f9afb7e7ca5182391

    2192597a0cc026fe6cf6f861cf4261c8eb95618a

    39efd14c0caa41aabc9cd05c4d7dae74

    d8fed5a9fa8baee68d241190f29a2e91f5c549a684cb66c92de3974fc9f3db22

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "de3.filedwnld.top" or url like "de3.filedwnld.top" or siteurl like "de3.filedwnld.top" or domainname like "https://fa5.flsdwnld.online/f5yxog/agree.exe" or url like "https://fa5.flsdwnld.online/f5yxog/agree.exe" or siteurl like "https://fa5.flsdwnld.online/f5yxog/agree.exe" or domainname like "re5.flsdwnld.online" or url like "re5.flsdwnld.online" or siteurl like "re5.flsdwnld.online" or domainname like "https://fa5.flsdwnld.online/f5yxog/sc5.exe" or url like "https://fa5.flsdwnld.online/f5yxog/sc5.exe" or siteurl like "https://fa5.flsdwnld.online/f5yxog/sc5.exe" or domainname like "https://de3.filedwnld.top/lwfdei/copyq-13.0.0.zip" or url like "https://de3.filedwnld.top/lwfdei/copyq-13.0.0.zip" or siteurl like "https://de3.filedwnld.top/lwfdei/copyq-13.0.0.zip" or domainname like "https://fa16.dwlfils.online/f16mqm/msupdate.exe" or url like "https://fa16.dwlfils.online/f16mqm/msupdate.exe" or siteurl like "https://fa16.dwlfils.online/f16mqm/msupdate.exe" or domainname like "re19.downlf.online" or url like "re19.downlf.online" or siteurl like "re19.downlf.online" or domainname like "fa4.fldwnld.online" or url like "fa4.fldwnld.online" or siteurl like "fa4.fldwnld.online" or domainname like "https://re5.flsdwnld.online/2/download/link" or url like "https://re5.flsdwnld.online/2/download/link" or siteurl like "https://re5.flsdwnld.online/2/download/link" or domainname like "https://fa2.filesdwnload.top/spdnsq/graph.exe" or url like "https://fa2.filesdwnload.top/spdnsq/graph.exe" or siteurl like "https://fa2.filesdwnload.top/spdnsq/graph.exe" or domainname like "re2.filesdwnload.top" or url like "re2.filesdwnload.top" or siteurl like "re2.filesdwnload.top" or domainname like "re1.filesdwnld.top" or url like "re1.filesdwnld.top" or siteurl like "re1.filesdwnld.top" or domainname like "https://fa4.fldwnld.online/f4yxje/nation.exe" or url like "https://fa4.fldwnld.online/f4yxje/nation.exe" or siteurl like "https://fa4.fldwnld.online/f4yxje/nation.exe" or domainname like "https://fa5.flsdwnld.online/f5yxog/confirm.exe" or url like "https://fa5.flsdwnld.online/f5yxog/confirm.exe" or siteurl like "https://fa5.flsdwnld.online/f5yxog/confirm.exe" or domainname like "imarketads.com" or url like "imarketads.com" or siteurl like "imarketads.com" or domainname like "dl2.filesdwnl.top" or url like "dl2.filesdwnl.top" or siteurl like "dl2.filesdwnl.top" or domainname like "https://fa2.filesdwnload.top/spdnsq/updater.exe" or url like "https://fa2.filesdwnload.top/spdnsq/updater.exe" or siteurl like "https://fa2.filesdwnload.top/spdnsq/updater.exe" or domainname like "re4.fldwnld.online" or url like "re4.fldwnld.online" or siteurl like "re4.fldwnld.online" or domainname like "fa103.aohoodie.com" or url like "fa103.aohoodie.com" or siteurl like "fa103.aohoodie.com" or domainname like "https://fa4.fldwnld.online/f4yxje/tube.exe" or url like "https://fa4.fldwnld.online/f4yxje/tube.exe" or siteurl like "https://fa4.fldwnld.online/f4yxje/tube.exe" or domainname like "https://fa103.aohoodie.com/olhsek/autumn.exe" or url like "https://fa103.aohoodie.com/olhsek/autumn.exe" or siteurl like "https://fa103.aohoodie.com/olhsek/autumn.exe" or domainname like "fa16.dwlfils.online" or url like "fa16.dwlfils.online" or siteurl like "fa16.dwlfils.online" or domainname like "api.grahql.workers.dev" or url like "api.grahql.workers.dev" or siteurl like "api.grahql.workers.dev" or domainname like "stats09.filldowl.online" or url like "stats09.filldowl.online" or siteurl like "stats09.filldowl.online" or domainname like "re103.aohoodie.com" or url like "re103.aohoodie.com" or siteurl like "re103.aohoodie.com" or domainname like "https://fa5.flsdwnld.online/f5yxog/dizzy.exe" or url like "https://fa5.flsdwnld.online/f5yxog/dizzy.exe" or siteurl like "https://fa5.flsdwnld.online/f5yxog/dizzy.exe" or domainname like "https://fa5.flsdwnld.online/f5yxog/hire.exe" or url like "https://fa5.flsdwnld.online/f5yxog/hire.exe" or siteurl like "https://fa5.flsdwnld.online/f5yxog/hire.exe" or domainname like "re20.downlfl.online" or url like "re20.downlfl.online" or siteurl like "re20.downlfl.online" or domainname like "re8.dowlfles.online" or url like "re8.dowlfles.online" or siteurl like "re8.dowlfles.online" or domainname like "fa2.filesdwnload.top" or url like "fa2.filesdwnload.top" or siteurl like "fa2.filesdwnload.top" or domainname like "conf.grahql.workers.dev" or url like "conf.grahql.workers.dev" or siteurl like "conf.grahql.workers.dev" or domainname like "webconf.shop-api.workers.dev" or url like "webconf.shop-api.workers.dev" or siteurl like "webconf.shop-api.workers.dev" or domainname like "https://fa3.filesdownld.top/ysosje/left.exe" or url like "https://fa3.filesdownld.top/ysosje/left.exe" or siteurl like "https://fa3.filesdownld.top/ysosje/left.exe" or domainname like "fa5.flsdwnld.online" or url like "fa5.flsdwnld.online" or siteurl like "fa5.flsdwnld.online" or domainname like "legio.name" or url like "legio.name" or siteurl like "legio.name" or domainname like "https://fa5.flsdwnld.online/f5yxog/WiSec.exe" or url like "https://fa5.flsdwnld.online/f5yxog/WiSec.exe" or siteurl like "https://fa5.flsdwnld.online/f5yxog/WiSec.exe" or domainname like "jrown.fun" or url like "jrown.fun" or siteurl like "jrown.fun" or domainname like "re104.artcnb.com" or url like "re104.artcnb.com" or siteurl like "re104.artcnb.com"

    Detection Query 2 :

    dstipaddress IN ("94.140.115.18","193.29.57.37","195.133.38.33","95.81.118.189","93.88.205.136","2.58.15.231","94.140.115.129","130.49.214.20","5.8.18.80","2.58.14.254","208.91.112.55","94.140.114.192") or srcipaddress IN ("94.140.115.18","193.29.57.37","195.133.38.33","95.81.118.189","93.88.205.136","2.58.15.231","94.140.115.129","130.49.214.20","5.8.18.80","2.58.14.254","208.91.112.55","94.140.114.192")

    Detection Query 3 :

    md5hash IN ("547bb05579fa34992289014088967e20","bc2b16989ae37c6e863439e8f329d23e","39efd14c0caa41aabc9cd05c4d7dae74","566fab5cd3596ebeceecd7decd3496a9","5bd635a72d6f89af394d98e025939eb6","3ae5ecc256090a896e7cd8c877f83c1b","2739dfad139f9e44a88b7fcc4749ddbb","36e80c375861d3ff0a55d5e49c8fe12e","a739bf9634e7094b69ecc286a629cf3c","393bb7b8df42079529858fa83178d769","718030cf248b7d25dbc5a3e5a37440f9","5658b64ebf3adc94f1ca13f802ec2f26","cce89a06b51d653f487dc7894dfa80e5","c19d914dc36ad6cff35c29d00e255223","1e3f6f093042fb880417bdca6cb59f11")

    Detection Query 4 :

    sha1hash IN ("29429aea8f9d7b281494a42c3b107c8358320d44","b99a884dee5a21eaad57048d581cd14ad8862924","a0063a9dfb75690beadbe4584cedf27d85186dc1","51c762e7387aad3e12219c72919e3d3aafb143fc","da2e2d910307d03164c3a1742e92a7c0d090c374","42803189646f339852174bb03189c2d1ce648203","6717b8d7be18ea5cdb5944c5b259e022496c6485","a2c6b58d1255b26af6194c7b0270371d91abc21d","2192597a0cc026fe6cf6f861cf4261c8eb95618a","4081f516e63d5daeec06c855fe5e7dd1953f62fd","f0eb24f7cb4fc861ad19007accd69868eb46111d","cd8515405738024b3c7a537901bf6712489b8739","ca304f45a6379a1411435186594a7297fbaf247d","46cbc561992ba98851700d87c4f8867985b2d0f4","c0a125258ef094c56ed3ad19b09c7b685fb042c6")

    Detection Query 5 :

    sha256hash IN ("35a75212862ce719ae6de1758949be33a3de787fab31e2d98436bacce8369d92","95fcab7e8892cb87bcadb523a4491bf10ee0788b859647ca7cca1e1d92d7519a","65060c1d1c6020ac445ea7b394ef9b1bd9aa23f27d9a508470403c7296924ce8","d8fed5a9fa8baee68d241190f29a2e91f5c549a684cb66c92de3974fc9f3db22","cd3163a308ba40c3a5e153c0326b7cf23a36debb6255624f9afb7e7ca5182391","c2fa32ac59f6424657a8513a7f158082877b97436b8502c3879f5736713e2132","9faa993d608c09eed5dcc9c945b8dd07431fcc192f0232ef379293622a1f3586","3f0dbc159dcdfb884ebc577dfe873d468617bf5a483bf832469cd209efbe84d4","9ea9f3efa1b594fc1ac4bc9dc75ac0f169d606ee1a4c6088b2b7432134643ea","bb96d21b7a61628724f13c6d4506b9d7bb56020d1c41fc79310f74666bb75904","23cb533bc3a5b535c06c8f0865e6cdebf442d56a7ac275baddcb9785279e4b88","44f8bd68487d0c40227ed44321cf16fc4a34d645252e98d6ba3f81e9f05e7900","d5572db12b800e87f986ef1138690ec5e17dfa5a0720dc75d453233ada88ee6d","2d8ea8fb20f1311e04ea88baa7cff957f6cb73899a524dc2bd39523e14ab022f","1cf3131b6f487067b3746dd4743544fbbfa553fb2941176b8213996aac61425c","746a693e2ba1bb50b941a6ea30026cce02ab9b64ffb9fa6168a62f7aa9557f0a","94b66ac8391ca543b0dffde6a2d475d29afce6fe32995eda76d379553da68407","219aa20e572dee9d1ef47ae1c33a851fc4fcecc5a45d15ce80c863da67cfeb10")

    Reference:    

    https://www.sophos.com/en-us/blog/chaos-in-teams-vishing                             


    Tags

    MalwareThreat ActorRansomwareMicrosoftPhishingVishingNorth AmericaBackdoorExfiltrationChaosInformation TechnologyExploit

    « Previous Article

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.