STAC5143

Executive Summary

STAC5143 is a financially motivated threat actor that targets small to medium‑sized organizations across media, finance and defense sectors using sophisticated Microsoft Office 365 services for initial access and remote exploitation. Their operations combine large‑scale email bombing with social engineering via Teams/Quick Assist to gain remote control, after which they deploy ransomware and backdoors while establishing persistence in cloud images and local systems. The group abuses legitimate third‑party web services for command‑and‑control, data exfiltration, and account hijacking, leveraging polymorphic code and service hijacking to evade detection.

Goals & Targeting

STAC5143’s primary strategic objective appears to be revenue generation through ransomware and extortion, specifically targeting small‑to‑medium businesses that are perceived as having lower security maturity. The actor prioritizes sectors where financial transactions or critical data can be leveraged for higher ransom yields—media, finance, defense, government, and IT services. By leveraging Microsoft Office 365 services, STAC5143 reduces the need to maintain independent infrastructure while gaining access to a wide array of victim assets. Their targeting profile reflects an opportunistic stance: they focus on organizations with limited MFA usage or poorly audited remote‑assistance tooling, enabling social engineering and credential theft for broader persistent compromise.

Key Capabilities

• Email Bombing initial access
• Social engineering via Microsoft Teams/Quick Assist for remote session takeover
• Download and deploy ransomware and backdoor malware
• Persistence through installation of malicious payloads (including in cloud images and containers)
• Reconnaissance & credential gathering (account discovery, service discovery, MFA interception)
• Data exfiltration via web services or other channels (cloud storage buckets)
• Account creation & management on email/cloud providers for infrastructure acquisition
• Exploitation of remote‑service vulnerabilities for lateral movement
• Hijack Windows service binaries via file‑permission abuse
• Spoofing HTTP headers/system attributes to blend malicious traffic
• Targeting multi‑factor authentication mechanisms for credential harvesting or bypass
• Network denial‑of‑service attacks for disruption/extortion
• Port scanning & vulnerability scanning to harvest service lists
• Polymorphic/mutating code & obfuscation techniques

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

STAC5143 has executed several ransomware campaigns that commence with automated email bombing to flood networks, followed by phishing or social‑engineering vectors exploiting remote assistance software. Victims are predominantly small or mid‑market businesses lacking robust MFA or audit controls, which allows the actor to achieve initial footholds quickly and establish persistence via cloud images and Windows services. The group demonstrates a high operational tempo—rapid recon, account provisioning, and exfiltration bursts—often completing the full attack lifecycle within days. Historically, STAC5143 has leveraged legitimate Microsoft assets (Teams, SharePoint, OneDrive) for staging files and command delivery, reducing their footprint in external infrastructure while maintaining stealth through polymorphic payloads and permission abuses.

IOC Patterns

• Mass email spam
• Remote assistance session requests via Microsoft Teams
• Local/domain account creation with `net user`
• Abuse of third‑party web services for C2 or exfiltration
• Suspicious bulk email/cloud accounts provisioning
• Unusual uploads to cloud storage buckets (S3, Dropbox, OneDrive)
• Modified Windows service binaries/permission changes
• Malicious images in container registries or AMI repositories
• Forged HTTP headers/user agents
• MFA interception/bypass attempts
• Network DoS traffic

Recommended Actions

• Monitor outbound email volume per user to detect Email Bombing patterns
• Restrict usage of remote assistance tools (Quick Assist, Teams screen sharing) to authorized personnel only
• Enforce multi‑factor authentication for all accounts, particularly those used for remote support
• Deploy endpoint detection and response solutions that flag suspicious downloads or installation of ransomware/backdoors
• Implement strict monitoring of local/domain account creation events
• Limit external exfiltration paths and inspect outbound traffic over web services (e.g., OneDrive, S3)
• Detect attempts to intercept or bypass MFA via anomaly detection
• Enforce strict file‑permission controls on Windows service binaries and directories
• Deploy file integrity monitoring for critical system executables
• Audit and restrict creation of cloud/email accounts; set alerts for bulk provisioning
• Use container image signing, scanning, and registry access control to prevent malicious imagery
• Employ traffic analysis/anomaly detection to identify spoofed user‑agent strings or forged headers
• Detect & mitigate network DoS attempts through rate limiting, IDS/IPS signatures

Suggested Tags

Sources