Attackers abuse Teams external chat to breach organizations quickly
Original title: Attackers Exploit Teams External Chat to Breach Organizations in Under 15 Minutes
Arctic Wolf saw more than 400 cases, often with email bombing and Quick Assist, and did not name the operators.
Arctic Wolf says threat actors are using Microsoft Teams external chat, enabled by default, to impersonate IT support and gain initial access. Across more than 400 incidents, newly created or acquired Microsoft 365 tenants contact employees, often after flooding inboxes with newsletters, and push them toward Quick Assist or commercial remote-management tools. Payload execution can follow in under 15 minutes, and some intrusions include PowerShell and lateral movement that could support ransomware. The October 26 report does not identify the perpetrators, though Black Basta has used Teams chat before.
Unconfirmed: Arctic Wolf did not identify the operators; similarity to Black Basta is historical, not attribution of these incidents.
- About 30–40% of cases used unverified onmicrosoft.com tenant domains.
- Tenant names often mimicked helpdesk or IT support, sometimes with a fake personal name.
- Quick Assist was the most common hands-on tool; AnyDesk and ScreenConnect were used for persistence.
- Arctic Wolf recommends allow-listing partner domains and blocking trial and unmanaged tenants.
Impact: Remote access, payload execution, and possible broader compromise
- 1.Limit Teams external access to specific partner domains and block unmanaged, consumer, and trial tenants.
- 2.Restrict Quick Assist to authorized IT roles and block or remove unsanctioned RMM tools.
- 3.Train users to check the External tag and report suspicious Teams messages.
- Vendors
- Microsoft
- Threat actors
- Black Basta
- Organizations
- Arctic Wolf
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onmicrosoft.com | t 365 tenants. Between 30-40% of the cases involved default onmicrosoft[.]com tenant domains, which do not require verification and can |
From the original article
3 min read at infosecurity-magazine.com
Arctic Wolf warned that the function enables highly effective social engineering attacks, which lead to incidents such as ransomware
By James Coker · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.