SynkLoader is leveraging Microsoft Teams to transform routine IT support interactions into malware delivery channels. This tactic uses impersonation rather than exploiting software vulnerabilities, putting the decision to install supposed fixes directly in front of unsuspecting employees.
How SynkLoader Operates
Attackers initiate contact through Teams messages and voice phishing, known as vishing, by posing as IT support staff. They persuade targets to download a malicious MSI installer named “PowerShell Cleaner,” effectively integrating a familiar workplace platform into their attack strategy.
Research from ReliaQuest Threat Research highlights that SynkLoader is a hash-gated PowerShell loader, notable for its combination of a convincing social engineering approach and minimal code visibility during inspection. The operation bypasses traditional security controls focusing on email attachments or overtly suspicious websites.
Technical Details of the Attack
By using legitimate Azure Blob Storage for malware delivery and maintaining key activities in memory, SynkLoader makes harmful downloads appear less suspicious and reduces detectable traces. The attack typically begins with a message or call appearing to come from an internal IT worker, offering help and framing the installer as a cleaning or repair tool.
The malicious MSI file is hosted on Azure Blob Storage, which, despite being legitimate, lends an air of credibility to the download. Once launched, the fake installer initiates the loader, advancing to the next stage without needing an email attachment.
Security Implications and Recommendations
After installation, SynkLoader decrypts its payload in memory, checking its cryptographic hash before execution. This step can frustrate automated analysis, as sandboxes may not witness the full infection sequence. The loader then deploys a Python backdoor, which retrieves its functionalities from command-and-control infrastructure as needed.
Organizations should limit unnecessary external communications via Teams and ensure employees verify unexpected support requests through known channels. Security teams need to monitor for MSI files launched from user-controlled folders or cloud-storage links and watch for irregular PowerShell or Python activity.
Devices that ran the fraudulent installer should be isolated and examined for additional payloads and command-and-control traffic. Ultimately, verification before installation is crucial, as a trusted platform and familiar support story do not ensure download safety.
Indicators of compromise (IoCs) include SHA-256 hashes and specific domains associated with SynkLoader activity. These should be used to bolster threat intelligence and enhance incident response efforts.
