Microsoft Teams IT Support Scams Deliver Malware and, in Some Cases, Chaos Ransomware
Summary
Arctic Wolf describes attackers exploiting external Microsoft Teams chats to impersonate IT support and gain remote access. In one observed chain, a Python implant queried Active Directory; Sophos says some related attacks deployed Chaos ransomware.
Key points
- Arctic Wolf says the pattern appears across hundreds of cases, with attackers using newly created or acquired Microsoft 365 tenants to impersonate IT support in external Teams chats.
- In many cases, email bombing precedes the Teams message, creating urgency before the purported support contact arrives.
- When external access is enabled, attackers use vishing to persuade victims to grant hands-on access through legitimate remote-management tools.
- Remote sessions have been used for reconnaissance, delivery of the GoGRPC backdoor, lateral movement, data exfiltration, and ransomware deployment.
- In one case, a user was instructed to run a PowerShell command that downloaded an MSI installer from Microsoft Azure Blob Storage; it launched a Python implant that queried Active Directory over LDAP and sent the results to an external server.
- Arctic Wolf says attackers may navigate to payloads during remote sessions instead of pasting URLs into Teams, making endpoint and identity telemetry important monitoring sources.
- Arctic Wolf says the activity aligns with STAC4749; Sophos reported that related attacks have deployed Chaos ransomware.
Article Details
- Attack Vectors
- External Microsoft Teams chats using IT-support impersonation and newly created or acquired Microsoft 365 tenants.
- Mail bombing followed by an urgent-seeming Teams support message.
- Vishing to persuade victims to grant hands-on-keyboard access through legitimate remote-access tools.
- A PowerShell command that downloads and launches an MSI installer, which runs a script that extracts and executes an embedded Python implant.
- Use of remote access for reconnaissance, payload delivery, lateral movement, and ransomware deployment.
- Defensive Notes
- Monitor endpoint and identity telemetry alongside message scanning; attackers may avoid pasting payload URLs into Teams and navigate to payloads during remote sessions.
- Review external Teams access and be alert to support-themed tenant names, display names, and messages following bursts of subscription-confirmation emails.
MITRE ATT&CK
T1059.001 · PowerShellA PowerShell command downloads an MSI, and the installer launches a PowerShell script to extract and execute an embedded Python implant.T1087.002 · Domain AccountThe backdoor issues LDAP queries to Active Directory for user objects.T1105 · Ingress Tool TransferThe PowerShell command downloads an MSI installer from Microsoft Azure Blob Storage.T1204.002 · Malicious FileIn one reported case, a user was instructed to run a PowerShell command that downloaded and launched an installer.T1219 · Remote Access ToolsAttackers obtain hands-on-keyboard access through legitimate remote-access tools, including Quick Assist, AnyDesk, and ScreenConnect.T1566.003 · Spearphishing via ServiceAttackers use external Microsoft Teams chats for IT-support impersonation and social engineering.
Threat Actors
Malware
Chaosemployee usernames to make the accounts appear authentic. These attacks have led to the deployment of Chaos ransomware, according to Sophos.GoGRPCThe remote access is abused to conduct reconnaissance, deliver additional payloads like the GoGRPC backdoor, facilitate lateral movement to domain controllers, and deploy additional RMM tools like Level for redundancy,
Vendors
Products
AnyDeskaccess through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.Ateramonitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.Level"We also observed a recent shift toward paid top-level domains (TLDs) for tenant creation," Arctic Wolf said. "Of the paid domains we identified in these types of scams over the past few months, approximately 50 percentLogMeInlike Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.Microsoft 365 Apps for EnterpriseTeams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.Microsoft Quick Assistthem hands-on-keyboard access through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.Microsoft Teamssay is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware.NetSupport(RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.ScreenConnectaccess through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.TeamViewerremote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.Zoho Assistand management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.