Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware - The Hacker News

Cybersecurity researchers have identified a recurring social engineering pattern where attackers use Microsoft Teams' external chat feature to conduct impersonation scams and deliver malware. According to Arctic Wolf Labs, these attacks follow a consistent pattern across hundreds of cases, using the same throwaway tenants, IT-themed display names, remote-access tools, and payload domains.

IT Impersonation Tactics

The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants. Nearly 30-40% of cases involve the use of *.onmicrosoft[.]com domains, which masquerade as IT infrastructure with help desk-themed names to increase credibility.

These Teams sessions are often preceded by mail bombing, where victims' inboxes are flooded with hundreds of newsletter or subscription confirmations to create a false sense of urgency. The IT support message then arrives shortly after to 'help resolve the problem.'

Domain Evolution

Researchers have observed a recent shift toward paid top-level domains (TLDs) for tenant creation. Of the paid domains identified in these scams, approximately 50% used the .top TLD, 40% used standard .com domains, and just over 5% used multi-level domains like .com.pl, .com.vn, and .com.br.

Attack Consequences

The activity aligns with that of STAC4749, which has a history of creating IT-themed cloud domains under the '.top' TLD and using plausible employee usernames to make accounts appear authentic. These attacks have led to the deployment of Chaos ransomware, according to Sophos.

Attackers specifically target organizations where external access is enabled, using vishing to trick victims into granting hands-on-keyboard access through legitimate remote monitoring and management tools like Quick Assist, AnyDesk, or TeamViewer. The remote access is then abused to conduct reconnaissance, deliver additional payloads like the GoGRPC backdoor, facilitate lateral movement, and deploy additional RMM tools before exfiltrating sensitive data and dropping ransomware.