Fake Microsoft Teams IT support used for remote access and malware
Original title: Fake Microsoft Teams IT Support Messages Lead to Remote Access and Malware Infections
Arctic Wolf tied more than 400 cases to external chats, inbox floods, and tools such as Quick Assist, sometimes within 15 minutes.
Arctic Wolf Labs reported more than 400 incidents in which attackers used Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware. Teams federation, enabled by default, let them contact employees without first compromising an internal account. Many cases began with email bombing, followed by a Teams message or call. Quick Assist was the most common remote tool, with AnyDesk, ScreenConnect, TeamViewer, and Atera also seen. At least three investigated compromises ended in encryption.
Unconfirmed: Arctic Wolf does not claim every observed case shares one operator, and it does not tie the new infection chain to a named malware family.
- Between 30 and 40 percent of cases used default onmicrosoft.com domains.
- About half of identified paid-domain cases used .top domains.
- Attackers often contacted several employees within about five minutes.
- One case used PowerShell and an MSI from Azure Blob Storage.
- Microsoft previously linked a similar sequence to Storm-1811 and Black Basta.
Impact: Remote control of employee PCs and follow-on malware or encryption
- 1.Restrict unnecessary Teams external federation and allow only trusted partner domains.
- 2.Control approved remote-support software and investigate unexpected installations.
- 3.Verify unsolicited helpdesk requests through known internal channels before granting access.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1566.004 Spearphishing VoiceT1219 Remote Access ToolsT1059.001 PowerShell
- Vendors
- Microsoft
- Threat actors
- Storm-1811
- Malware
- Black BastaChaos
- Organizations
- Arctic WolfSophos
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onmicrosoft.com | etween 30 and 40 percent of analyzed cases involved default onmicrosoft[.]com domains. How to switch off the “External Access” setting |
From the original article
3 min read at gbhackers.com
More than 400 incidents in which attackers abused Microsoft Teams external chats to impersonate IT support, obtain remote access, and deliver malware. Researchers identified recurring tenant names, deceptive display names, remote administration tools, and payload infrastructure across incidents. Teams federation, enabled by default, allows communication between organizations when both tenants permit external access.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.