Microsoft Details Teams Helpdesk Impersonation Attacks Using Quick Assist
Summary
Microsoft describes intrusions using external Teams chats to impersonate helpdesk staff, gain access via Quick Assist, move laterally with WinRM, and collect data with Rclone. It recommends treating external contacts as untrusted and monitoring remote-access tools.
Key points
- Microsoft reports multiple intrusions using external Teams chats to impersonate IT or helpdesk staff and persuade employees to grant remote access.
- Attackers commonly use Quick Assist to control a target's machine, then use Command Prompt and PowerShell for reconnaissance.
- The reported chain includes payload execution through trusted signed applications using DLL side-loading, HTTPS-based C2, and persistence through Windows Registry modifications.
- Attackers use WinRM for lateral movement, including toward domain controllers and other high-value systems.
- Microsoft says attackers use Rclone or similar tools to collect selected sensitive data and transfer it to external cloud storage.
- Microsoft recommends treating external Teams contacts as untrusted and restricting or monitoring remote-assistance tools and WinRM.
Article Details
- Attack Vectors
- Attackers use external Microsoft Teams chats to impersonate IT or helpdesk personnel and persuade employees to start a remote-support session, usually through Quick Assist.
- After gaining remote access, attackers perform reconnaissance, execute payloads through trusted signed applications using DLL side-loading, establish HTTPS-based command-and-control, and modify the Windows Registry for persistence.
- Attackers use WinRM for lateral movement, then use Rclone or similar tools to collect filtered sensitive data and transfer it to external cloud storage.
- Defensive Notes
- Treat contacts from outside the organization in Teams as untrusted by default and heed Teams warnings about external communications and possible phishing.
- Restrict or closely monitor remote-assistance tools and limit WinRM usage to controlled systems.
MITRE ATT&CK
T1021.006 · Windows Remote ManagementAttackers abuse WinRM to move laterally across the network.T1059.001 · PowerShellPowerShell is used during initial reconnaissance.T1059.003 · Windows Command ShellCommand Prompt is used during initial reconnaissance.T1071.001 · Web ProtocolsThe established command-and-control communication uses HTTPS.T1112 · Modify RegistryAttackers modify the Windows Registry to establish persistence.T1219 · Remote Access ToolsAttackers commonly use Quick Assist to gain direct control of an employee's machine.T1566.003 · Spearphishing via ServiceAttackers contact targets through external Microsoft Teams chats and use impersonation to persuade them to grant remote assistance.T1567.002 · Exfiltration to Cloud StorageAttackers use Rclone or similar tools to exfiltrate selected sensitive data to external cloud storage.T1574.002 · DLL Side-LoadingAttackers execute payloads through trusted signed applications using DLL side-loading.T1656 · ImpersonationAttackers pose as company IT or helpdesk personnel in external Teams chats.
Vendors
Products
Microsoft Quick AssistThe attackers leverage legitimate tools and native protocols—including Quick Assist, signed applications, WinRM, and Rclone—to blend malicious activity into normal IT operations, making detection difficult.Microsoft TeamsMicrosoft warns that threat actors are increasingly abusing external Microsoft Teams collaboration, impersonating IT or helpdesk staff to trick employees into granting remote access and enabling lateral movement forMicrosoft Windowsexecute the malicious code through a trusted, signed application (e.g., Autodesk, Adobe Acrobat/Reader, Windows Error Reporting, data loss prevention software) via DLL side-loading.
Tools
Command PromptFrom there, the attacker performs quick reconnaissance using Command Prompt and PowerShell, checking privileges, domain membership, and network reachability to evaluate the potential for lateral movement.PowerShellFrom there, the attacker performs quick reconnaissance using Command Prompt and PowerShell, checking privileges, domain membership, and network reachability to evaluate the potential for lateral movement.RCloneThe attackers leverage legitimate tools and native protocols—including Quick Assist, signed applications, WinRM, and Rclone—to blend malicious activity into normal IT operations, making detection difficult.