Likely Former Black Basta Affiliates Target Executives With Automated Teams Help-Desk Scams

Summary

ReliaQuest says a likely former Black Basta affiliate campaign pairs email bombing with Teams help-desk impersonation and RMM tools to target executives, reporting rapid access and recommending verification, tool controls, and targeted training.

Key points

ReliaQuest assesses that former Black Basta affiliates are highly likely involved, while noting that collaboration with other groups or imitation remain possible.
The reported sequence combines email bombing with impersonation of IT support through Microsoft Teams to pressure targets into remote-access sessions.
From March 1 to April 1, 2026, 77% of observed incidents targeted senior-level employees, up from 59% in January and February.
Some observed activity moved from initial chat engagement to script execution in as little as 12 minutes; attackers used Supremo and Quick Assist for remote access.
ReliaQuest says it has not observed ransomware deployment in the incidents described, though the activity is consistent with pre-ransomware staging.
Recommended defenses include out-of-band verification for remote-access requests, strict controls on RMM tools, and targeted simulations for senior staff.

Article Details

Attack Vectors: Mass email bombing followed by help-desk impersonation through Microsoft Teams or phone calls to create urgency and gain remote access.
Social engineering of senior employees to persuade them to join sessions using Supremo Remote Desktop or Quick Assist.
Execution of scripts such as MailAccountWizard.jar during remote-management sessions for pre-ransomware staging.
Defensive Notes: Require out-of-band, multi-channel verification for help-desk requests involving remote access.
Use application allow-listing and restrict approved RMM tools to authorized IT personnel; control Quick Assist execution for general users.
Train executives and managers with simulations that combine email bombing and urgent Teams impersonation.
Alert on email-bomb activity followed by suspicious Teams outreach and RMM-tool execution.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`griffinintl[.]net`	Domain identified in connection with a help-desk impersonation identity.
DOMAIN	`groupbiocare[.]com`	Domain identified in connection with a help-desk impersonation identity.
IPV4	`84[.]42[.]92[.]111`	Threat actor-linked source IP address used to initiate contact.
IPV4	`84[.]42[.]92[.]176`	Threat actor-linked source IP address used to initiate contact.
IPV4	`84[.]42[.]92[.]225`	Threat actor-linked source IP address used to initiate contact.
IPV4	`84[.]42[.]94[.]127`	Threat actor-linked source IP address used to initiate contact.