Search — “cleaner.ps1”

Arctic Wolf analyzed 400+ incidents where attackers mail-bomb victims then contact them via external Microsoft Teams 1:1 chats posing as "IT Support (Internal)" from throwaway onmicrosoft or .top tenants, using vishing to get Quick Assist or other RMM access. In one case the victim ran a PowerShell command (parent explorer.exe) that fetched an MSI from Azure Blob Storage, dropping cleaner.ps1 into AppData\Local\PowershellCleaner\scripts, which launched a pythonw implant (ss.py) that ran LDAP enumeration via adsisearcher and sent results to C2. Activity aligns with Sophos-tracked STAC4749 leading to Chaos ransomware. Hunt for external ChatCreated events, unsanctioned RMM execution, and pythonw/PowerShell spawned from msiexec in user AppData.