Cato Details Teams Vishing Delivery of PhantomBackdoor
Summary
Cato CTRL researchers describe a Teams helpdesk-impersonation incident in which guided screen sharing led to staged PowerShell, host-data collection, and a WebSocket backdoor. They recommend tighter Teams controls and PowerShell monitoring.
Key points
- Cato says the victim reported a threat-actor interaction that began with a Microsoft Teams meeting invite and helpdesk impersonation.
- After the interaction, obfuscated PowerShell retrieved staged payloads from hxxps://maxsolutions243[.]com/background and ran them in memory.
- The observed payload collected the computer name, domain, username, process ID, and UUID, then XOR-encrypted and Base64-encoded the data before sending it to C2.
- The final stage established an interactive WebSocket C2 connection to ws://maxsolutions243[.]com:80.
- Cato reports overlap with SentinelOne’s PhantomBackdoor/PhantomCaptcha reporting, but describes a different delivery method involving Teams vishing.
- Cato MDR flagged lateral movement and follow-on activity; recommended defenses include helpdesk call-back verification, restricting external Teams access and screen sharing, and monitoring and hardening PowerShell.
Article Details
- Attack Vectors
- Vishing and helpdesk impersonation initiated through a Microsoft Teams meeting invite; guided screen sharing persuaded the victim to execute staged PowerShell.
- Obfuscated PowerShell retrieved and staged additional payloads in memory, followed by host reconnaissance and a WebSocket-based command-and-control session.
- Defensive Notes
- Require ticket validation and callback procedures for helpdesk requests, and instruct users to verify requests through official channels before running commands or installing software.
- Restrict external Microsoft Teams access to approved tenants and trusted domains; limit screen sharing and disable remote control for external participants unless required.
- Monitor for the sequence of a Teams session, PowerShell execution, and outbound download. Harden PowerShell, limit its capabilities for standard users, and detect obfuscated download-and-execute behavior and suspicious WebSocket communications.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | halungroup[.]com | Listed in the article as C2 and staging infrastructure. |
| DOMAIN | maxsolutions243[.]com | Attacker-controlled staging and command-and-control domain used to retrieve payloads and communicate with the backdoor. |
| IPV4 | 104[.]238[.]133[.]25 | Listed as threat-actor hosting or infrastructure. |
| IPV4 | 162[.]252[.]172[.]74 | Listed as threat-actor hosting or infrastructure. |
| SHA256 | 1497ad4cd9b3f009904896464b090ad2ff4c932f2bb57752bb19b53b2ec65ea0 | SHA-256 hash of an observed payload. |
| SHA256 | b0c07b265c9d9046038ffa48d5b8e17b8ba0791503beba85196cdbe0ac2fcb27 | SHA-256 hash of an observed payload. |
| URL | hxxps[:]//maxsolutions243[.]com/background | Malicious staging URL used to initiate PowerShell retrieval and payload delivery. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe payload chain used obfuscated PowerShell, and collected data was XOR-encrypted and Base64-encoded.T1059.001 · PowerShellObfuscated PowerShell was retrieved and executed to stage the payload chain.T1071.001 · Web ProtocolsThe final backdoor stage used a WebSocket session for interactive command and control.T1082 · System Information DiscoveryThe malware collected the computer name, domain, username, process ID, and system UUID.T1105 · Ingress Tool TransferThe malware retrieved next-stage payloads from attacker-controlled infrastructure.T1204 · User ExecutionThe victim was guided during screen sharing to execute the staged PowerShell.T1566.003 · Spearphishing via ServiceThe article maps initial access to a Microsoft Teams meeting invite and interaction used in the vishing-driven delivery.
Malware
Vendors
Products
Cato IPSthe lateral movement and follow-on stages, and Cato XOps correlated the activity into a Story, while Cato IPS can help contain future attempts by blocking known-bad infrastructure and disrupting WebSocket-based C2.Cato MDRCato MDR/XOps flagged lateral movement and follow-on stages; recommended mitigations include helpdesk verification workflows, restricting external Teams features, and PowerShell monitoring/hardening.Cato XOpsas identified by Cato MDR/XOps (‘Cato MDR flagged the lateral movement and follow-on stages, and Cato XOps correlated the activity into a Story’)Microsoft TeamsCato CTRL researchers observed a vishing-driven delivery that used Microsoft Teams helpdesk impersonation and screen sharing to coax a victim into executing staged PowerShell, which loaded an in-memory payload andPowerShellused Microsoft Teams helpdesk impersonation and screen sharing to coax a victim into executing staged PowerShell, which loaded an in-memory payload and established a WebSocket-based backdoor.
Countries
ItalyCato CTRL has discovered a q-based delivery technique used against an Italy-based consumer services company associated with PhantomBackdoor, a multi-stage WebSocket-based backdoor previously reported in aUkrainecompany associated with PhantomBackdoor, a multi-stage WebSocket-based backdoor previously reported in a Ukraine-focused spear phishing operation by SentinelOne.