Fake Microsoft Teams IT support used for remote access and malware
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
76
Product
TeamViewer
- Mentions · 7d3
- Mentions · 30d5
- All mentions8
- First seenSep 2, 2026
- Last mentioned3d ago
Timeline
8 articles · newest firstAttackers impersonate IT support on Microsoft Teams to gain remote access
An October 26 Arctic Wolf report on more than 400 incidents also describes a PowerShell and MSI infection chain.
76
Teams IT-support impersonation used to deploy malware and ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
74
FBI says SafePay breached more than 600 organizations since 2024
U.S., German, and U.K. agencies say the gang guesses passwords, phishes, and exploits listed flaws.
78
Zscaler says ransomware gangs use AI to select data for extortion
ThreatLabz cites 896.2 TB stolen by the top 10 groups and a healthcare payment of $2 million with no encryption.
58
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
Russian national facing 20 years for malware campaign that infected 80,000 freelancers
US prosecutors indicted Russian national Searzhudin Aktulaev for a 2016 TVRAT malware campaign that infected 80,000 freelance platform users, carrying up to 20 years.
35
Russian Man Extradited Over Malware Campaign Targeting Freelancers
A Russian national was extradited to the US for allegedly spreading TVRAT and DarkVNC malware to 80,000 freelance platform users via Excel attachments.
35
Related CVEs
by mentions- CVE-2024-4071190%9.8Unauthenticated Deserialization RCE in Veeam Backup & Replication
- CVE-2024-4076618%9.8Improper Access Control in SonicWall SonicOS Management (Gen 5/6/7 Firewalls)
- CVE-2023-2026927%9.1Unauthenticated Brute-Force VPN Access in Cisco ASA and Firepower Threat Defense
- CVE-2020-325972%7.5Unauthenticated Memory-Disclosure Flaw in Cisco ASA and FTD Web Services
- CVE-2023-2753281%7.5Missing Authentication in Veeam Backup & Replication Exposes Stored Credentials
- CVE-2026-42542<1%7.5TDengine: In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process by sending a single…
Appears with
- Microsoftvendor · 7
- AnyDeskproduct · 5
- Microsoft Teamsproduct · 4
- Quick Assistproduct · 3
- ScreenConnectproduct · 3
- TeamSpymalware · 2
- Sophosorganization · 2
- Chaosmalware · 2
- Ateraproduct · 2
- TVRATmalware · 2
- TeamViewervendor · 2
- VNC Viewerproduct · 2
- FBIorganization · 2
- TVSPYmalware · 2
- Arctic Wolforganization · 2
- DarkVNCmalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.