Ransomware Alert: STAC5143 & STAC5777 Target Microsoft 365 and Teams

Ransomware has struck again, and this time the target remains no stranger to cybercriminal schemes—Microsoft’s suite of services. Over the past three months, not one but two new ransomware factions have surfaced, exploiting Microsoft 365 and Microsoft Teams default configurations to launch sophisticated, targeted campaigns. The culprits? Groups named STAC5143 and STAC5777, whose methods highlight the evolving face of cyberattacks in the cloud and collaboration-centric era.
Let’s unravel the full extent of these campaigns, break down their tactics, and discuss how organizations and end-users can stay secure.

---

The Two-Pronged Threat: Meet STAC5143 and STAC5777​

STAC5143: The Social Engineering Specialist​

STAC5143 employed a spam-heavy strategy as its entry point. The campaign bombarded victims with phishing emails that paved the way for a clever follow-up attack—a Microsoft Teams call, seemingly coming from someone named “Help Desk Manager.” The end goal of this social engineering con? Granting the attackers remote screen control through Teams itself. Once granted control, the attackers executed malicious commands and installed backdoors to expand their presence on the compromised systems.
Key tactics used by STAC5143:

• Spam campaigns: A deluge of phishing messages designed to attack users' sense of security and urgency.
• Masquerading as tech support: Leveraging Teams’ default configurations to mimic internal IT help desks.
• Backdoor deployment: Creating persistence within an organization’s network for future exploitation.

STAC5777: The Hands-On Hacker​

While STAC5143 stayed true to phishing and impersonation tricks, STAC5777 preferred a more active approach—using Microsoft Quick Assist, a legitimate remote assistance tool, as its primary attack vector. By tricking employees into downloading and using Quick Assist, STAC5777 gained full access to their devices. Once inside, the group conducted in-depth reconnaissance and lateral movements across the network, attempting to deploy Black Basta ransomware.
Key tactics used by STAC5777:

• Quick Assist manipulation: A crafty use of legitimate Microsoft tools for nefarious purposes.
• Lateral movement: Once inside one device, gaining access to others in the network.
• Ransomware deployment: Using data from reconnaissance efforts to launch ransomware attacks.

The techniques employed by these groups blur the line between malicious tools and legitimate enterprise software, making detection and prevention increasingly challenging.

---

Why Microsoft Teams and Quick Assist?​

These attacks leveraged two widely-used Microsoft services—Teams and Quick Assist—which raise an important question: why target these tools specifically?

Microsoft Teams​

Teams is among the most popular collaboration tools globally, with a rapidly growing user base of enterprise employees. Unfortunately, its default configurations often prioritize usability over security, which can facilitate social engineering attacks such as those seen in STAC5143's campaign. Attackers exploited:

• Familiarity: Internal employees trust communication originating within Teams.
• Few safeguards: Default settings don’t require strict identity verification for remote control requests.

Microsoft Quick Assist​

Quick Assist is another useful tool for IT remote monitoring and troubleshooting. However, being baked directly into the Windows operating system, it’s an easy target because:

• It’s pre-installed: Users are less likely to question its legitimacy.
• Users aren’t trained to scrutinize requests: Employees rarely question the IT department when asked to use support tools.

In both cases, attackers exploit human trust as much—or more—than technical vulnerabilities.

---

The Big Picture: Implications and Broader Industry Trends​

What’s happening here reflects a burgeoning reality in cybersecurity: the marriage of social engineering and cloud-based enterprise tools.

1. Human Behavior is the Weakest Link​

Both STAC5143 and STAC5777’s campaigns show that even robust technical defenses can crumble when users fail to spot red flags. Social engineering thrives on:

• Inducing panic or urgency.
• Pretending to be a trusted entity.

If users don’t double-check identities or communications, ransomware will continue to flourish.

2. Legitimate Tools as Trojan Horses​

Nearly every enterprise uses platforms like Teams or Quick Assist. By piggybacking on these trusted ecosystems, attackers avoid detection by traditional antivirus and security measures. This is a reminder that even legitimate tools can be weaponized.

3. Ransomware Evolution​

Attackers are getting smarter about escalating privilege inside systems. After early successes, groups like STAC5143 and STAC5777 are leveraging advanced persistent threat (APT) tactics—taking their time to carefully infiltrate networks, move laterally, and maximize damage potential.

---

Protect Yourself: Practical Defense Strategies for Organizations​

Avoiding the clutches of ransomware isn’t just about having the right tools—it’s also about empowering your organization with the right mindset and training. Here’s what to do:

1. Reconfigure Default Settings​

• Harden Teams’ default configurations by enabling more stringent access policies. For example, prevent external users/unknown senders from initiating calls.
• Require multi-factor authentication (MFA) to verify support requests.

2. Train Employees Against Social Engineering​

Sophos researchers emphasized incorporating attack awareness into employee training. Specifically:

• Teach users to recognize phishing attempts and spoofed communications.
• Encourage vigilance against sudden IT requests. Double-check with supervisors or an established IT help desk contact before granting software control or installing tools.

3. Monitor and Restrict Remote Assistance Features​

• Disable Microsoft Quick Assist company-wide unless strictly needed for IT workflows.
• Use software restrictions and policy-based permissions to ensure attackers can't weaponize native support tools.

4. Implement Endpoint Detection and Response (EDR)​

Deploy systems that actively monitor and mitigate suspicious activity in real-time, including unusual remote access requests or data exfiltration patterns.

5. Keep Systems Patched​

Always install the latest updates for your Microsoft services. Patching isn't flashy, but vulnerabilities in unpatched software give attackers an opening.

---

Wrapping Up: A Call to Vigilance​

Microsoft’s prominence and global reach make its ecosystem a prime target for imaginative attackers. The STAC5143 and STAC5777 campaigns prove that ransomware operators are doubling down on creativity and exploitation of human error. To combat these threats, enterprises need to combine policy changes, user education, and vigilant monitoring.
Here’s the harsh truth: attackers don’t need new vulnerabilities in software when they have willing—or unwitting—users to exploit. So, let’s stay proactive, ask questions when something feels “off,” and make cybercriminals work harder for every inch they try to gain in our networks. Push back now, and let threats like STAC5143 and STAC5777 know they’re no match for an educated workforce equipped with both knowledge and the right tools.

---

Source: ChannelE2E https://www.channele2e.com/brief/microsoft-services-exploited-in-separate-ransomware-campaigns