STAC5143 is a threat actor group tracked by Sophos, notable
for its sophisticated use of Microsoft Office 365\'s legitimate services to
conduct ransomware and data extortion campaigns. Unlike FIN7, which typically
targets larger organizations through phishing and malicious Google Ads,
STAC5143 focuses on smaller victims across diverse business sectors. Their
operations begin with overwhelming targeted individuals with email bombing,
followed by Microsoft Teams messages impersonating tech support to initiate a
remote screen control session. Utilizing Microsoft\'s Quick Assist or direct
Teams screen sharing, they deploy malware, including Java Archive (JAR) files
and Python-based backdoors, from external SharePoint file stores.
mso-ascii-theme-font:minor-latin;mso-fareast-font-family:Aptos;mso-fareast-theme-font:
minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;mso-ansi-language:EN-US;mso-fareast-language:
EN-US;mso-bidi-language:AR-SA\">This cluster exploits legitimate services within
the Microsoft Office 365 platform, using a Java-based proxy to execute
PowerShell commands and download malicious payloads. While employing publicly
available tools like RPivot, their obfuscation methods and the use of
side-loaded DLLs for command and control, combined with the deployment of Black
Basta ransomware in one instance, indicate a sophisticated and evolving threat
actor adapting known techniques for their specific objectives
