DenoGate Backdoor Delivered Through Microsoft Teams IT-Helpdesk Impersonation
Summary
eSentire analyzed a campaign that used email bombing and Microsoft Teams helpdesk impersonation to trick a retail customer into installing DenoGate, a Deno-based backdoor capable of command execution, persistence, and TCP tunneling.
Key points
- In June 2026, eSentire identified the campaign targeting a retail customer. Attackers flooded victims with spam, then posed as IT helpdesk staff through Microsoft Teams.
- The attackers sent a purported patch hosted on Amazon S3 and instructed victims to download and run it; the archive contained DenoGate files and the Deno runtime.
- DenoGate uses a WebSocket connection to a CloudFront-based command-and-control server and sends victim details, including domain, username, computer name, and network information.
- Its modules support command execution through cmd.exe, persistence through the Windows HKCU Run registry key, and TCP tunneling that can route connections through the victim’s device.
- eSentire’s analysts isolated the affected host and assisted with remediation. The company said it was monitoring related campaigns and developing detection content.
- The report recommends restricting or requiring approval for external Microsoft Teams contacts and using endpoint detection and response capabilities.
Article Details
- Attack Vectors
- Email bombing followed by Microsoft Teams messages or calls in which operators impersonated the victim organization's IT helpdesk.
- Victims were sent an Amazon S3-hosted page with instructions to download, unpack, and execute an archive named patch01309.txt containing the DenoGate backdoor.
- DenoGate maintained C2 communications over WebSockets and exposed local HTTP endpoints for command execution and TCP tunneling.
- Defensive Notes
- Restrict or disable external Microsoft Teams messaging from unrecognized tenants where feasible; at minimum, require explicit approval before accepting contacts from external organizations.
- Use a 24/7 multi-signal MDR provider, or at minimum NGAV or EDR, to detect and contain threats.
- eSentire reported that its SOC analysts isolated the affected host and assisted with remediation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | d1mjrkjsk5qy13[.]cloudfront[.]net | DenoGate command-and-control domain. |
| SHA256 | ff5a477871a4b83e2b38e660f28ef998680dcb6ba21fddff3e3f66c04ffc3596 | SHA-256 of the DenoGate archive identified as patch01309.txt. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryDenoGate collects network configuration and routing information using ipconfig /all and route print.T1057 · Process DiscoveryDenoGate collects a process list using tasklist.T1059.003 · Windows Command ShellVictims were directed to execute commands in Windows Command Prompt; DenoGate also invokes cmd.exe for command execution.T1059.007 · JavaScriptDenoGate consists of JavaScript modules executed using the Deno runtime.T1071.001 · Web ProtocolsDenoGate communicates with its C2 server over WebSockets using HTTP-based communication.T1090 · ProxyDenoGate's TCP tunneler lets operators use a compromised victim machine as a proxy.T1204.002 · Malicious FileVictims were instructed to download, unpack, and execute the DenoGate archive.T1498.002 · Reflection AmplificationOperators flooded victim email inboxes with spam before contacting them through Teams.T1547.001 · Registry Run Keys / Startup FolderDenoGate establishes persistence by adding a value to the HKCU Run registry key.T1566.002 · Spearphishing LinkOperators sent phishing links through Microsoft Teams while impersonating the victim organization's IT helpdesk.
Malware
Vendors
Products
Denomalicious links containing step-by-step instructions guiding victims to download, unpack, and execute a Deno-based backdoor from the command prompt that TRU is tracking as "DenoGate", named for its ability to turnMicrosoft TeamsIn June 2026, eSentire's Threat Response Unit (TRU) identified a Microsoft Teams-based phishing campaign targeting a customer in the Retail industry. Threat actors first bombarded victims with email spam before posing