Cybersecurity
Teams support scams deliver malware and ransomware
Arctic Wolf Labs said attackers had used Microsoft Teams external chats, fake IT-support identities and mail bombing to reach victims, gain remote access and in some cases deploy Chaos ransomware.
- Arctic Wolf Labs said it had found a recurring pattern across hundreds of cases in which attackers used Microsoft Teams external chats for impersonation scams or malware delivery.
- The company said about 30% to 40% of the cases used *.onmicrosoft.com tenants with help desk or support-themed names, and that some display names also copied the target organisation's domain or company name.
- Arctic Wolf said the activity matched STAC4749, while Sophos said the attacks had led to Chaos ransomware.
- In some incidents, attackers used vishing and remote-access tools to gain hands-on access, and one case involved a PowerShell command that fetched an MSI from Microsoft Azure Blob Storage and launched a script that extracted a Python implant and queried Active Directory.
Arctic Wolf Labs said the attacks began with Microsoft Teams chats sent from external identities that posed as internal support staff. The messages often arrived after mail bombing, which flooded inboxes with subscription confirmations and made the victim more likely to engage.
The company said many of the identities used newly created or acquired Microsoft 365 tenants and permanent *.onmicrosoft.com domains made to look like help desks or IT teams. It also said a recent change saw more use of paid domains, with .top making up most of the examples it identified among those cases.
Arctic Wolf said the same activity aligned with STAC4749, a group it linked to IT-themed cloud domains and plausible employee names. The attackers then used remote-access software, including tools such as Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn, to move from chat to access.
The company said the remote sessions were used for reconnaissance, extra payloads and lateral movement before data theft and ransomware deployment. In one case, the target was told to run PowerShell, which downloaded an MSI from Microsoft Azure Blob Storage; the installer then launched code that unpacked a Python implant and queried Active Directory.
Named in this story
Companies
- Sophos
- Said the attacks had led to Chaos ransomware
Organisations
- Arctic Wolf Labs
- Issued the report describing the pattern
- STAC4749
- Was the activity cluster Arctic Wolf said this campaign matched
Products and systems
- Microsoft Teams
- Its external chat feature was abused for the scams
- Microsoft 365
- Provided the newly created or acquired tenants used by the attackers
- Chaos ransomware
- Was deployed in some cases
- Quick Assist
- One of the remote-access tools used
- AnyDesk
- One of the remote-access tools used
- ScreenConnect (ConnectWise)
- One of the remote-access tools used
- TeamViewer
- One of the remote-access tools used
- Atera
- One of the remote-access tools used
- Zoho Assist
- One of the remote-access tools used
- NetSupport
- One of the remote-access tools used
- LogMeIn
- One of the remote-access tools used
- Level
- An additional RMM tool used for redundancy
- PowerShell
- Was used to download and launch a file in one case
- Microsoft Azure Blob Storage
- Hosted the MSI installer in one case
- Active Directory
- Was queried for computer and user objects
- GoGRPC
- Was deployed as a backdoor in some cases
How the source tells it
Measured and reportorial; it presents the activity as a vendor analysis rather than leaning on hype or alarm.
No emotive framing was found in the original.