cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Teams Phishing Campaign Uses Quick Assist to Deploy A0Backdoor

· Original article ↗

Summary

BlueVoyant describes a campaign targeting financial and healthcare organizations through Teams impersonation and Quick Assist, using signed MSI files and DLL sideloading to deploy A0Backdoor. Researchers assess links to Black Basta tactics with moderate-to-high—

Key points

  • Attackers reportedly flood employees with spam, then impersonate company IT staff on Microsoft Teams and persuade them to start a Quick Assist session.
  • Signed MSI installers hosted in personal Microsoft cloud storage masquerade as Teams components or CrossDeviceService and use DLL sideloading to load a malicious hostfxr.dll.
  • The loaded library decrypts embedded shellcode, which performs sandbox detection and derives a SHA-256 key to decrypt A0Backdoor with AES.
  • A0Backdoor fingerprints hosts using Windows APIs; its excessive thread creation may crash a debugger, but researchers say it has little impact during normal execution.
  • The malware uses DNS MX queries with encoded, high-entropy subdomains for command-and-control; MX responses carry encoded command data, potentially evading controls focused on TXT-based tunneling.
  • BlueVoyant says targets include a Canadian financial institution and a global healthcare organization.
  • BlueVoyant assesses with moderate-to-high confidence that the campaign evolves tactics associated with Black Basta, while noting signed MSIs, malicious DLLs, A0Backdoor, and DNS MX-based C2 as new elements.

Article Details

Attack Vectors
  • Attackers reportedly flooded employees' inboxes with spam, then contacted them over Microsoft Teams while impersonating company IT staff.
  • Employees were persuaded to start Quick Assist remote sessions and install signed MSI files hosted in a personal Microsoft cloud storage account.
  • The MSI installers masqueraded as Microsoft Teams components and CrossDeviceService; a legitimate Microsoft binary loaded a malicious hostfxr.dll through DLL sideloading.
  • The loaded library decrypted embedded shellcode, which used sandbox detection and extracted the encrypted A0Backdoor payload.
  • A0Backdoor communicated with command-and-control infrastructure using DNS MX queries with encoded data in subdomains and encoded commands in MX responses.

MITRE ATT&CK

T1033 · System Owner/User DiscoveryA0Backdoor used GetUserNameExW to collect information about the host user.T1071.004 · DNSA0Backdoor used DNS MX queries and responses to exchange encoded command-and-control data.T1082 · System Information DiscoveryA0Backdoor used Windows APIs, including GetComputerNameW, to collect host information and fingerprint the system.T1204.002 · Malicious FileEmployees were persuaded to install malicious MSI files as part of the attack.T1219 · Remote Access ToolsAttackers instructed employees to use Quick Assist to provide remote access during the intrusion.T1497.001 · System ChecksThe shellcode performed sandbox detection before extracting A0Backdoor.T1574.002 · DLL Side-LoadingThe malicious hostfxr.dll was loaded through DLL sideloading with legitimate Microsoft binaries.T1622 · Debugger EvasionThe malicious library used excessive CreateThread calls, which researchers said could cause a debugger to crash and hinder analysis.

Threat Actors

BlackBastaBlueVoyant assessed with moderate-to-high confidence that the campaign evolved tactics, techniques, and procedures associated with BlackBasta; the article notes the gang had dissolved after its internal chat logs were leaked.

Malware

A0BackdoorAttackers used social engineering over Microsoft Teams to trick employees at financial and healthcare organizations into initiating Quick Assist remote sessions and installing signed MSI files that deploy A0Backdoor.

Vendors

BlueVoyantAccording to researchers at cybersecurity company BlueVoyant, the malicious MSI files masquerade as Microsoft Teams components and the CrossDeviceService, a legitimate Windows tool used by the Phone Link app.MicrosoftAttackers used social engineering over Microsoft Teams to trick employees at financial and healthcare organizations into initiating Quick Assist remote sessions and installing signed MSI files that deploy A0Backdoor.

Products

CrossDeviceServiceMalicious MSI installers hosted in personal Microsoft cloud storage masquerade as Teams components and CrossDeviceService and rely on DLL sideloading to load a malicious hostfxr.dll.Microsoft Phone LinkAccording to researchers at cybersecurity company BlueVoyant, the malicious MSI files masquerade as Microsoft Teams components and the CrossDeviceService, a legitimate Windows tool used by the Phone Link app.Microsoft Quick AssistAttackers used social engineering over Microsoft Teams to trick employees at financial and healthcare organizations into initiating Quick Assist remote sessions and installing signed MSI files that deploy A0Backdoor.Microsoft TeamsAttackers used social engineering over Microsoft Teams to trick employees at financial and healthcare organizations into initiating Quick Assist remote sessions and installing signed MSI files that deploy A0Backdoor.Microsoft WindowsThe loaded library decrypts embedded shellcode, performs sandbox detection, derives a SHA-256 key to AES-decrypt the A0Backdoor, and fingerprints hosts using Windows APIs.

Countries

CanadaBlueVoyant states that two of the targets of this campaign are a financial institution in Canada and a global healthcare organization.

Industries

HealthcareAttackers used social engineering over Microsoft Teams to trick employees at financial and healthcare organizations into initiating Quick Assist remote sessions and installing signed MSI files that deploy A0Backdoor.

Related Articles