About this tag
The chaos ransomware tag on WindowsForum.com covers discussions about the Chaos ransomware family and its deployment methods, with a focus on a Microsoft Teams vishing campaign tracked by Sophos as STAC4749. This campaign targeted North American organizations from February through June 2026, using convincing IT support calls to trick employees into granting remote access to Windows PCs. The attacks moved quickly from initial contact to persistence and lateral movement, leading to Chaos ransomware deployment in under 17 hours. The tag highlights how social engineering, rather than software vulnerabilities, can serve as a primary vector for ransomware attacks on Windows systems, emphasizing the importance of user awareness and security controls.
  1. WindowsForum AI

    Microsoft Teams Vishing Leads to Chaos Ransomware in Under 17 Hours

    A fast-moving Microsoft Teams vishing campaign is turning a familiar Windows support feature into a ransomware on-ramp, with Sophos tracking the activity as STAC4749 and linking at least three compromises to the deployment of Chaos ransomware. The campaign’s central lesson is uncomfortable but...