Email bombing and external Teams chats used for remote access
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
68
Product
AnyDesk
- Mentions · 7d6
- Mentions · 30d9
- All mentions20
- First seenAug 12, 2026
- Last mentioned3d ago
Timeline
20 articles · newest firstSpam floods precede fake IT-support chats in Microsoft Teams
Arctic Wolf documented more than 400 cases; remote-access tools can be installed in under 15 minutes, sometimes leading to ransomware.
64
Attackers abuse Teams external chat to breach organizations quickly
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
76
Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Attackers impersonate IT support on Microsoft Teams to gain remote access
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
76
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
FBI says SafePay breached more than 600 organizations since 2024
U.S., German, and U.K. agencies say the gang guesses passwords, phishes, and exploits listed flaws.
78
Zscaler says ransomware gangs use AI to select data for extortion
ThreatLabz cites 896.2 TB stolen by the top 10 groups and a healthcare payment of $2 million with no encryption.
58
Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access
Researchers released AnyPwn, a working pre-auth root exploit for AnyDesk Linux before 8.0.3.
67
Hackers Used a Samsung Flaw to Build a Cryptominer Inside Victim Systems
Huntress says attackers used Samsung MagicINFO CVE-2025-4632 on one Windows host to compile a Monero miner.
58
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
82
H1 2026 Malware Vulnerability Trends
Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.
78
Attackers plant remote access tools on compromised PaperCut servers
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
78
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.
65
Medusa ransomware gang has hit over 500 organizations, CISA warns
FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.
75
More than 200 victims of Medusa ransomware identified over the last year, CISA says
CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.
70
Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
55
Akira Ransomware Uses Safe Mode to Bypass EDR
An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.
74
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.
78
Related CVEs
by mentions- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2025-31161100%9.8Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
- CVE-2026-2376096%9.3Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
- CVE-2023-2026927%9.1Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense
- CVE-2023-2152959%8.8Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
- CVE-2024-170895%8.4Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
- CVE-2020-325972%7.5Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2024-27199100%7.3Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
- CVE-2025-27918<1%9.8An issue was discovered in AnyDesk for Windows before 9.0.5, AnyDesk for macOS before 9.0.1, AnyDesk for Linux before 7.0.0, AnyDesk for iOS before 7.1.2, and…
Appears with
- Microsoftvendor · 14
- Microsoft Teamsproduct · 7
- Quick Assistproduct · 6
- ScreenConnectproduct · 6
- Arctic Wolforganization · 5
- TeamViewerproduct · 5
- SimpleHelpproduct · 5
- Huntressvendor · 3
- CISAorganization · 3
- Huntressorganization · 3
- Ateraproduct · 3
- FBIorganization · 3
- Chaosmalware · 3
- AnyDeskvendor · 3
- Sophosorganization · 3
- XWormmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.