Teams IT-support impersonation used to deploy malware and ransomware
Original title: Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Arctic Wolf ties hundreds of cases to throwaway Microsoft 365 tenants, mail bombing, RMM tools, and sometimes Chaos ransomware.
Arctic Wolf Labs describes a recurring pattern in which attackers use Microsoft Teams external chat, often after mail bombing, to impersonate IT support. Messages come from new or acquired Microsoft 365 tenants, including onmicrosoft.com and paid domains, and target organizations with external access enabled. Callers push victims to grant access through legitimate remote-monitoring tools, then run reconnaissance, deploy payloads such as the GoGRPC backdoor, move laterally, steal data, and in some cases drop ransomware. Sophos has linked related activity and Chaos ransomware to STAC4749.
Unconfirmed: Arctic Wolf describes a recurring pattern; the Chaos ransomware link is attributed to Sophos.
- Nearly 30–40 percent of investigated cases used *.onmicrosoft.com tenant domains.
- About half of recent paid fake-identity domains used the .top TLD.
- Tools included Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.
- One case used PowerShell to fetch an MSI from Azure Blob Storage that launched a Python implant.
- Attackers avoided pasting URLs in Teams to bypass Safe Links and ZAP scanning.
Impact: Remote access, data theft, and ransomware deployment
- 1.Watch for Teams chats from new tenants using IT-support display names after inbox flooding.
- 2.Monitor endpoint and identity telemetry, not only Teams message scanning.
- ATT&CK
- T1566 PhishingT1566.004 Spearphishing VoiceT1219 Remote Access SoftwareT1059.001 PowerShellT1486 Data Encrypted for Impact
- Vendors
- Microsoft
- Threat actors
- STAC4749
- Organizations
- Arctic Wolf LabsSophos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onmicrosoft.com | estigated by the cybersecurity company involve the use of *.onmicrosoft[.]com , a permanent fallback domain automatically generated by |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware. "A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.