--- title: MS Teams Chaos Leads to Chaos Ransomware description: Hackers are using spoofed Microsoft Teams calls to deploy Chaos ransomware. Learn how this attack works—and how to protect your organization. image: https://www.irongatesecurity.com/hubfs/thumbnail_IRONGATE_CareerPosts_Miner_1200x600_v2-1.jpg --- [Skip to the main content.](https://www.irongatesecurity.com/ironintel/ms-teams-chaos-leads-to-chaos-ransomware#main-content) [![Plexos\_IronGate\_Logo\_Final-2](https://www.irongatesecurity.com/hs-fs/hubfs/Plexos_IronGate_Logo_Final-2.png?width=1246&height=190&name=Plexos_IronGate_Logo_Final-2.png "Plexos_IronGate_Logo_Final-2")](https://www.irongatesecurity.com) [![Plexos\_IronGate\_Logo\_Final-2](https://www.irongatesecurity.com/hs-fs/hubfs/Plexos_IronGate_Logo_Final-2.png?width=1246&height=190&name=Plexos_IronGate_Logo_Final-2.png "Plexos_IronGate_Logo_Final-2")](https://www.irongatesecurity.com) - [Who We Are](https://www.irongatesecurity.com/who-we-are) - [Our Leaders](https://www.irongatesecurity.com/who-we-are#our-leaders) - [Services](https://www.irongatesecurity.com/services) - [Active Defense](https://www.irongatesecurity.com/active-defense) - [Governance, Risk & Compliance](https://www.irongatesecurity.com/governance-risk-compliance) - [Security Operation (SecOps) Services](https://www.irongatesecurity.com/security-operation-services) - [Digital Forensics and Incident Response (DFIR)](https://www.irongatesecurity.com/digital-forensics-incident-response) - [Insurance Advisory Services](https://www.irongatesecurity.com/insurance-advisory-services) - [Why IronGate](https://www.irongatesecurity.com/why-irongate) - [How We Work](https://www.irongatesecurity.com/how-we-work) - Resources - [IronINTEL Blog](https://www.irongatesecurity.com/ironintel) - [Careers](https://www.irongatesecurity.com/careers) [![CONTACT US](https://no-cache.hubspot.com/cta/default/43428275/interactive-129984586382.png)](https://www.irongatesecurity.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJV%2F%2Bz3sH4FuFMmYw750BWc9p%2F6sd1nSyY%2FbFJnG%2BqbjyGrj%2FScvbyd5CZZJzpHY64sg6zSkBIvNPHdi9TosEO28b698KuegHyCFA27JE%2B0Q8Lwrz3FVk36CvKYLiDAum5uIy8uhfkjviz0LSjG4EUiPlAVt3fjP9UCZMxps4tfjPvPlDMkMtes2pdNfoTz0NsWn4Ty0A%3D%3D&webInteractiveContentId=129984586382&portalId=43428275) Toggle Menu Toggle Menu [![CONTACT US](https://no-cache.hubspot.com/cta/default/43428275/interactive-129984586382.png)](https://www.irongatesecurity.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJV%2F%2Bz3sH4FuFMmYw750BWc9p%2F6sd1nSyY%2FbFJnG%2BqbjyGrj%2FScvbyd5CZZJzpHY64sg6zSkBIvNPHdi9TosEO28b698KuegHyCFA27JE%2B0Q8Lwrz3FVk36CvKYLiDAum5uIy8uhfkjviz0LSjG4EUiPlAVt3fjP9UCZMxps4tfjPvPlDMkMtes2pdNfoTz0NsWn4Ty0A%3D%3D&webInteractiveContentId=129984586382&portalId=43428275) - [Who We Are *Toggle Menu*](https://www.irongatesecurity.com/who-we-are) - [Our Leaders](https://www.irongatesecurity.com/who-we-are#our-leaders) - [Services *Toggle Menu*](https://www.irongatesecurity.com/services) - [Active Defense *Toggle Menu*](https://www.irongatesecurity.com/active-defense) - [Governance, Risk & Compliance](https://www.irongatesecurity.com/governance-risk-compliance) - [Security Operation (SecOps) Services](https://www.irongatesecurity.com/security-operation-services) - [Digital Forensics and Incident Response (DFIR)](https://www.irongatesecurity.com/digital-forensics-incident-response) - [Insurance Advisory Services](https://www.irongatesecurity.com/insurance-advisory-services) - [Why IronGate](https://www.irongatesecurity.com/why-irongate) - [How We Work](https://www.irongatesecurity.com/how-we-work) - Resources *Toggle Menu* - [IronINTEL Blog](https://www.irongatesecurity.com/ironintel) - [Careers](https://www.irongatesecurity.com/careers) 1 min read # MS Teams Chaos Leads to Chaos Ransomware [![Picture of IronGate](https://www.irongatesecurity.com/hubfs/IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) Jun 5, 2025, 1:22:42 PM ![MS Teams Chaos Leads to Chaos Ransomware](https://www.irongatesecurity.com/hubfs/thumbnail_IRONGATE_CareerPosts_Miner_1200x600_v2-1.jpg) **For immediate assistance with a network intrusion, ransomwareattack, or BEC, please contact: [IrongateResponse@irongatesecurity.com](mailto:IrongateResponse@irongatesecurity.com)**   The adversaries deploying chaos ransomware have recently gained initial access to corporate networks by spoofing Microsoft Teams calls. The threat group has been observed to call potential victims via MS Teams from a spoofed email and once connected, the adversary represents they are from the helpdesk. The adversary’s intention is to socially engineer the victim to screen share via Teams and allow control enabling the adversary to download and install malware on the victim’s computer. Once the malware is installed, the adversary disconnects, only to return through their malware and deploy ransomware to the corporate network.    - The user (victim) receives an unsolicited call appearing to be from corporate IT helpdesk. - The caller (adversary) tricks the user into allowing a screen share and enabling control by stating they need to install some updates, and it will only take a few minutes. - The caller (adversary) downloads malware to the user’s (victim) system to install a potential backdoor. - Once installation is successful, the caller (adversary) disconnects. - Moments later, the adversary returns through the backdoor to deploy ransomware. Notable Observations: - The time from the initial call to deployment of ransomware has been observed to be short, only a few hours. - Average ransom demand for Chaos is **$3,750,000,** average payment is **$807,500,** average negotiated discount is approximately 78%. - Victim organizations have been observed to have hundreds of employees to several thousand across multiple industries including Insurance, Engineering, and Real Estate   Mitigation Recommendations:  - Educate your organization to verify the identity of unsolicited callers as well as your organizations procedures for how IT will initiate contact to the employees. - Review and scrutinize the callers email address to identify mistyped email domains. - Ask the caller to “go on camera” and have them perform a series of actions to attempt to identify the use of deepfake technology. - Disconnect from the call with the unsolicited caller and call IT directly from a trusted phone number or contact method. - IT can disable communications from external sources (this wouldn’t affect the use of Teams conference calls).      [Contact us](https://www.irongatesecurity.com/contact) today to learn more about our [Digital Forensics and Incident Response (DFIR)](https://www.irongatesecurity.com/digital-forensics-incident-response) services. [![CONTACT US](https://no-cache.hubspot.com/cta/default/43428275/interactive-129984586382.png)](https://www.irongatesecurity.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJV%2F%2Bz3sH4FuFMmYw750BWc9p%2F6sd1nSyY%2FbFJnG%2BqbjyGrj%2FScvbyd5CZZJzpHY64sg6zSkBIvNPHdi9TosEO28b698KuegHyCFA27JE%2B0Q8Lwrz3FVk36CvKYLiDAum5uIy8uhfkjviz0LSjG4EUiPlAVt3fjP9UCZMxps4tfjPvPlDMkMtes2pdNfoTz0NsWn4Ty0A%3D%3D&webInteractiveContentId=129984586382&portalId=43428275) | ![Ramey](https://www.irongatesecurity.com/hs-fs/hubfs/Ramey.png?width=276&height=276&name=Ramey.png) | [Steve Ramey](https://www.irongatesecurity.com/steve-ramey) has spent the past two decades helping clients protect, investigate, and respond to events involving their digital interests. He has led hundreds of data breach investigations, assessed incident response and security programs, and successfully advised organizations through extortion negotiations. | | --- | --- |   [![Charting Your Path in Cybersecurity by Uncovering Your Core Focus & Interests](https://www.irongatesecurity.com/hubfs/thumbnail_IRONGATE_CareerPosts_Miner_1200x600_v2.jpg)](https://www.irongatesecurity.com/ironintel/charting-your-path-in-cybersecurity-by-uncovering-your-core-focus-interests) #### [Charting Your Path in Cybersecurity by Uncovering Your Core Focus & Interests](https://www.irongatesecurity.com/ironintel/charting-your-path-in-cybersecurity-by-uncovering-your-core-focus-interests) [![Picture of IronGate](https://www.irongatesecurity.com/hs-fs/hubfs/IronGate%20Favicon.png?width=30&name=IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) : Jun 13, 2024, 3:40:38 PM IronGate CEO Steve Ramey's practical guide to identifying which cybersecurity career path could be right for you. [Read More](https://www.irongatesecurity.com/ironintel/charting-your-path-in-cybersecurity-by-uncovering-your-core-focus-interests) [![Navigating the Cybersecurity Maze: Carving Your Path in a Multifaceted Domain](https://www.irongatesecurity.com/hubfs/IRONGATE_CareerPosts_Maze_1200x600_v4.jpg)](https://www.irongatesecurity.com/ironintel/navigating-the-cybersecurity-maze-carving-your-path-in-a-multifaceted-domain) #### [Navigating the Cybersecurity Maze: Carving Your Path in a Multifaceted Domain](https://www.irongatesecurity.com/ironintel/navigating-the-cybersecurity-maze-carving-your-path-in-a-multifaceted-domain) [![Picture of IronGate](https://www.irongatesecurity.com/hs-fs/hubfs/IronGate%20Favicon.png?width=30&name=IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) : Jun 14, 2024, 1:45:00 PM IronGate Cybersecurity CEO Steve Ramey blog series about how to focus on your chosen track, become an expert, and give back to the community. [Read More](https://www.irongatesecurity.com/ironintel/navigating-the-cybersecurity-maze-carving-your-path-in-a-multifaceted-domain) [![How to Embed Defense in Your Cloud and DevOps Management](https://www.irongatesecurity.com/hubfs/Credit%20Card.jpg)](https://www.irongatesecurity.com/ironintel/how-to-embed-defense-in-your-cloud-and-devops-management) #### [How to Embed Defense in Your Cloud and DevOps Management](https://www.irongatesecurity.com/ironintel/how-to-embed-defense-in-your-cloud-and-devops-management) [![Picture of IronGate](https://www.irongatesecurity.com/hs-fs/hubfs/IronGate%20Favicon.png?width=30&name=IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) : Sep 26, 2023, 12:30:48 PM Steve Ramey delivers an up-to-the-minute understanding of the threat landscape and how you can use new technologies to heighten your firm's... [Read More](https://www.irongatesecurity.com/ironintel/how-to-embed-defense-in-your-cloud-and-devops-management)   ![Plexos\_IronGate\_Logo\_Final-2](https://www.irongatesecurity.com/hs-fs/hubfs/Plexos_IronGate_Logo_Final-2.png?width=301&height=46&name=Plexos_IronGate_Logo_Final-2.png) ![Irongate\_Award\_Logos](https://www.irongatesecurity.com/hs-fs/hubfs/Irongate_Award_Logos.png?width=557&height=210&name=Irongate_Award_Logos.png)   - [Privacy Policy](https://www.irongatesecurity.com/privacy-policy) - [Terms of Use](https://www.irongatesecurity.com/terms-of-use) - [Your Privacy Choices ![](https://www.irongatesecurity.com/hubfs/privacyoptions.png)](https://www.irongatesecurity.com/your-privacy-choices) © 2026 IronGate Cybersecurity LLC [*LinkedIn*](https://www.linkedin.com/company/irongate-cybersecurity-llc/?lipi=urn%3Ali%3Apage%3Ad_flagship3_search_srp_companies_load_more%3BcMuuS27qSPaVn%2BG%2BihNnZw%3D%3D) *Return to Top* ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "IronGate", "url" : "https://www.irongatesecurity.com/ironintel/author/irongate" }, "dateModified" : "2025-06-05T17:22:42.723Z", "datePublished" : "2025-06-05T17:22:42.000Z", "headline" : "MS Teams Chaos Leads to Chaos Ransomware", "image" : [ "https://www.irongatesecurity.com/hubfs/thumbnail_IRONGATE_CareerPosts_Miner_1200x600_v2-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.irongatesecurity.com/ironintel/ms-teams-chaos-leads-to-chaos-ransomware", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.irongatesecurity.com/hubfs/Plexos_IronGate_Logo_Final-1.png" }, "name" : "IronGate Cybersecurity LLC" } } ```