STAC4749
STAC4749 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 5 sectors, including Manufacturing, and Energy and Utilities, in the United States and Canada. It uses 28 MITRE ATT&CK techniques.
- Techniques
- 28
- Exploited CVEs
- No CVE data
- First seen
- Feb 1, 2026
- Last seen
- Jun 1, 2026
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
28 techniques across 9 of 14 tacticsArsenal · Malware And Tools.
- Chaos RaaS ransomwaremalware
- AnyDesktool
- Dwagenttool
- Quick Assisttool
- RemSupptool
Indicators Of Compromise.
- IP
193[.]29[.]57[.]37 - Domain
re104[.]artcnb[.]com
86 more indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout STAC4749.
STAC4749 is a financially motivated intrusion cluster that gains initial access to corporate networks by impersonating internal helpdesk and IT support staff in external chat messages and voice calls on a widely used enterprise collaboration platform. Its operators create IT-themed cloud domains under the.top top-level domain with plausible employee-style user names, and persuade employees during short calls, typically two to two and a half minutes, to open a remote session through a built-in remote assistance tool or a cloud-based remote monitoring and management tool.
Between February and June 2026 (month-level precision) the cluster targeted dozens of organizations, nearly 95 percent of them in Canada and the United States, in the services, manufacturing, energy, construction and engineering sectors and among legal organizations specializing in intellectual property law or services. At least three intrusions ended with the deployment of Chaos ransomware, and several of the cluster's tactics align with activity previously linked to that ransomware program.
Last updated Nov 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.