cyber.hendryadrian.com
Security News · darkreading.com

Attackers Abuse Microsoft Teams External Chats in Fast Malware-Delivery Campaign

· Original article ↗

Summary

Arctic Wolf describes more than 400 incidents using email bombing and fake IT-support chats in Microsoft Teams to gain remote access; it says about 15% progressed to successful compromise. Attribution remains inconclusive, with Black Basta-associated activity a major a

Key points

  • Arctic Wolf reported a recurring pattern across more than 400 incidents, using email bombing followed by an external Teams chat impersonating IT support.
  • Attackers persuade employees to grant remote access, most commonly through Quick Assist; follow-on activity may include malware execution, credential theft, reconnaissance or ransomware deployment.
  • A typical sequence includes system reconnaissance, a PowerShell payload, command-and-control activity, credential access using Kerberos abuse, and a second remote-access tool.
  • Arctic Wolf said roughly 15% of cases progressed beyond the initial stage to successful compromise. It did not definitively attribute the activity, but described Black Basta-associated activity as a significant driver.
  • The research noted a shift from throwaway onmicrosoft[.]com tenants toward attacker-controlled domains; about half of observed cases involving paid domains used .top domains.
  • Arctic Wolf identified the Teams ChatCreated event as a primary detection point and recommended restricting external chats and federation, allowing only trusted organizations, and hardening remote access.
  • Microsoft said Teams would introduce AI-powered phishing detection for higher-risk messaging scenarios the following month; the article also notes campaigns combining Teams chat abuse with ClickFix-style social engineering.

Article Details

Event Type
Large-scale social engineering campaign abusing Microsoft Teams external chats and email bombing to obtain remote access and deliver malware.
Impact
Arctic Wolf described a recurring pattern across more than 400 incidents. Justin Moore said roughly 15% progressed to successful compromise. Reported follow-on activity includes malware execution, credential theft, reconnaissance, and possible ransomware deployment; the article says payload execution can occur in under 15 minutes.

MITRE ATT&CK

T1033 · System Owner/User DiscoveryThe reported reconnaissance sequence includes whoami.T1059.001 · PowerShellThe described attack sequence includes a PowerShell-based payload.T1082 · System Information DiscoveryThe reported reconnaissance sequence includes systeminfo.T1219 · Remote Access ToolsAttackers persuade victims to launch legitimate remote-access software, including Quick Assist and other named products.T1558.003 · KerberoastingThe article specifically identifies Kerberoasting as a Kerberos abuse method used to access credentials.T1656 · ImpersonationAttackers impersonate internal IT support in external Teams chats to persuade employees to grant remote access.

People

Justin MooreArctic Wolf director of adversary operations who discussed campaign compromise rates and attribution uncertainty.Shubham DubeyArctic Wolf author who described the campaign pattern and attacker behavior in the cited blog post.

Threat Actors

Black BastaMicrosoft researchers identified Black Basta using email bombing for social engineering in mid-2024. Justin Moore said Black Basta-associated activity remains a significant driver of Teams chat abuse, while noting that definitive attribution for recent attack waves was not possible.

Vendors

Arctic WolfIn a blog post on Monday, Arctic Wolf detailed the campaign, and what it described as a "recurring social engineering pattern" across more than 400 incidents in the wild. Threat actors use Microsoft Teams' external chatMicrosoftThreat actors are abusing Microsoft Teams' external chat functionality at scale, using IT-support impersonation and email bombing tactics to trick employees into granting remote access. Attackers target multiple users

Products

AnyDeskthe employee to launch a remote-access session via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.Ateraa remote-access session via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.LogMeIntooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.Microsoft Quick AssistThe impersonator persuades the employee to launch a remote-access session via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.Microsoft TeamsThreat actors are abusing Microsoft Teams' external chat functionality at scale, using IT-support impersonation and email bombing tactics to trick employees into granting remote access. Attackers target multiple usersNetSupportvia legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.ScreenConnectto launch a remote-access session via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.Zoho Assistsession via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.

Related Articles