Email bombing and external Teams chats used for remote access
Original title: Email Bombing, External Teams Chats Form Repeatable Access Path
Arctic Wolf reports the pattern in more than 400 incidents, with Quick Assist most often used before credential theft.
Arctic Wolf describes a repeatable social-engineering pattern in which attackers email-bomb employees, then contact them through Microsoft Teams external chat while posing as IT support. Victims are persuaded to start a session with legitimate remote-access tools, most often Quick Assist. After access, attackers run reconnaissance and PowerShell payloads, abuse Kerberos, and install a second remote-access tool that can survive removal of the first implant. Ransomware is described as a possible later stage.
Unconfirmed: The excerpt ends before fully describing email bombing, and no specific threat group is named.
- Arctic Wolf says it saw the pattern across more than 400 incidents.
- Attackers reuse throwaway tenants and the display name “IT Support (Internal).”
- Quick Assist is the most common tool; AnyDesk, ScreenConnect and others also appear.
- Follow-on activity includes Kerberoasting and what Arctic Wolf calls GoldenPAC.
- A second commercial remote-access tool is meant to outlast removal of the first implant.
Impact: Remote control of employee machines and credential theft
- 1.Treat unexpected external Teams chats from “IT Support (Internal)” as suspicious.
- 2.Block or tightly control Quick Assist and other remote-access tools named in the incidents.
- ATT&CK
- T1566.003 Spearphishing via ServiceT1219 Remote Access SoftwareT1059.001 PowerShellT1558.003 Kerberoasting
- Vendors
- Microsoft
- Organizations
- Arctic Wolf
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onmicrosoft.com | frastructure front, Arctic Wolf noted a move from throwaway onmicrosoft.com tenants toward attacker-controlled domains, especially ".to |
| md5 | 7c184611bdd9df51982cc5bb2d5ba649 | vest-cloud-credentials#recipe=similar-items&sourcecontentid=7c184611bdd9df51982cc5bb2d5ba649) APT41 Delivers 'Zero-Detection' Backdoor to Harvest Cloud |
| md5 | 8f99d4e59eef3c1106085563b00071e8 | t-mythos-exploit-storm#recipe=similar-items&sourcecontentid=8f99d4e59eef3c1106085563b00071e8) CSA: CISOs Should Prepare for Post-Mythos Exploit Storm b |
| md5 | dedc2d87d0611657e649f3ccd3b03e96 | rastructure-crime-bots#recipe=similar-items&sourcecontentid=dedc2d87d0611657e649f3ccd3b03e96) TeamPCP Turns Cloud Infrastructure Into Crime Bots by Jai |
| md5 | e89675326c5a58c3d1742cab0ff9c2e8 | ts-power-offensive-ops#recipe=similar-items&sourcecontentid=e89675326c5a58c3d1742cab0ff9c2e8) Attackers Seize Exposed AI Endpoints to Power Offensive O |
From the original article
8 min read at darkreading.com
A common mix of impersonation, domain infrastructure, and trusted software is helping attackers scale Microsoft Teams intrusions across organizations.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.