A ransomware crew is getting into corporate networks by phoning employees on Microsoft Teams and posing as the help desk. Sophos tracks the operation as STAC4749 and has tied it to at least three deployments of Chaos ransomware between February and June, against dozens of North American organizations split almost evenly between the United States and Canada, in services, manufacturing, energy and construction. Callers using names like Anthony Brooks and Dylan Harper talked staff into opening Microsoft Quick Assist or RemSupp remote sessions, then planted backdoors and additional remote access tools. In one intrusion, per the researchers, "less than 17 hours passed between the initial Microsoft Teams contact and the deployment of ransomware." Sophos analyst Morgan Demboski said the evidence "is most consistent with a financially motivated cybercriminal operation rather than state-sponsored actors," and the firm links the operators to former members of the BlackSuit and Royal gangs.
Water utilities had a harder week than help desks. More than 30 community water systems across Minnesota were hit in a coordinated two-day attack on the automated controls that run treatment and distribution. South St. Paul reported "a cyberattack on Monday that impacted certain automated controls" and, after switching to contingency procedures, "confirmed no major impact to drinking and wastewater treatment operations. Drinking water remains safe for use." The FBI, EPA and CISA are working with the affected utilities, and no attribution has been announced, though earlier attacks on the same class of water-plant controllers have been linked to CyberAv3ngers, a group tied to Iranian intelligence. Braham mayor Nate George said "Minnesota's local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology and inadequate resources."
The chip industry logged its own disclosure. Analog Devices, the Massachusetts semiconductor maker with about 24,000 employees, told securities regulators that intruders accessed its systems and stole files in an incident detected June 23. The company said the breach "did not disrupt its operations" and that it is "not aware of the files being leaked or used for malicious purposes." An extortion group calling itself ExfilSquad claimed 570,000 records, a figure the company has not confirmed, and the listing has since disappeared from the group's leak site.
Fairlife, the Coca-Cola dairy unit knocked offline earlier in the month, is mostly back. The company said "a majority of production has been resumed at the four Fairlife facilities in the US" and confirmed the incident involved the "taking of certain data." Anubis, the group behind the attack, claims roughly one terabyte of files.
Three of the four stories turn on the same weakness: not the firewall, but whatever sits behind it with the least attention, whether a persuadable employee, a small-town utility running aging controllers, or files parked where an intruder can reach them. The perimeter held almost nowhere it mattered, and the recoveries came from contingency plans rather than prevention.
Leave a Reply