Arctic Wolf Labs reports hundreds of cases in which attackers use Microsoft Teams external chat to impersonate IT support and deliver malware from newly created or acquired Microsoft 365 tenants.
The report offers a concrete look at how tenant identity, display names and social engineering can combine in an attack; Sophos says the activity has led to Chaos ransomware deployment.
How to set the trap
The process often begins with sending a multitude of automated emails, which flood the victim's mailbox to create a sense of urgency.
Shortly after, a message appears in Microsoft Teams from someone claiming to be from technical support. The attackers use profile names such as “Help Desk,” “IT Support,” or variations of the target company’s name to gain the employee’s trust.
To send these messages, the perpetrators use either addresses automatically provided by the platform or web addresses purchased for a fee. This activity is linked to a group that leverages technical support-related addresses and employee names that appear real.
From message to remote access
Once the employee is convinced they are talking to a technician, the scammers convince them to give them access to their computer using common, legitimate remote administration programs. In some cases, they ask the user to give verbal approval or perform actions, such as downloading files from an online data repository.
READ ALSO
New spyware steals passwords on Telegram and WeChat
Once they gain access to the device, the attackers search the company's internal network, install programs to move stealthily and, according to researchers, in some cases install malicious software that locks down the organization's files. This method relies on tricking people and abusing legitimate tools.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)