Arctic Wolf: Teams IT-support chats used in 400-plus intrusions

Arctic Wolf says attackers used default Teams external chat to impersonate IT support in more than 400 cases, often installing remote-access tools within minutes.

Arctic Wolf Labs says threat actors are impersonating IT support in Microsoft Teams external chats, which are enabled by default and are not described as a Teams vulnerability. Across more than 400 incidents, newly created or acquired Microsoft 365 tenants contact employees, often after email bombing, and push legitimate remote tools, most often Quick Assist. Access can lead within about 15 minutes to PowerShell payloads, a Python implant, reconnaissance, lateral movement, data theft, and sometimes ransomware. Arctic Wolf does not name the operators. Microsoft previously tied a similar Teams sequence to Storm-1811 and Black Basta; later reporting has associated related activity with other ransomware brands, including Chaos.