Cybersecurity experts have raised alarms about a growing pattern of cyber attacks exploiting Microsoft Teams. These attacks involve external chat features to impersonate IT support, facilitating the delivery of malware and ransomware. Researchers at Arctic Wolf Labs have identified a consistent modus operandi among threat actors using similar tenant names, display names, and payload domains.
Impersonation Techniques in Microsoft Teams
Attackers frequently use IT-themed display names to bypass external-user warnings on Teams. These fraudulent identities are crafted through new or acquired Microsoft 365 tenants, often using the *.onmicrosoft[.]com domain. This domain is automatically generated during tenant creation, allowing attackers to disguise themselves as legitimate IT support entities.
Common tenant names observed include helpdeskteam365.onmicrosoft[.]com and itendpoint365.onmicrosoft[.]com, among others. This tactic is coupled with an initial mail bombing strategy, overwhelming victims’ inboxes with spam to create urgency. The fraudulent Teams message follows, offering supposed IT assistance.
Evolving Tactics and Recent Trends
Recent developments in these scams show attackers incorporating target organizations’ domains into their display names to enhance credibility. Arctic Wolf noted a shift towards using paid top-level domains (TLDs) for tenant creation, with the .top TLD being prevalent. Approximately 50% of these domains use .top, while others employ .com and multi-level domains.
The group known as STAC4749 is particularly notorious for using IT-themed cloud domains under the .top TLD, making their operations appear legitimate. Their attacks frequently result in the deployment of Chaos ransomware, as reported by Sophos, targeting organizations with enabled external access.
Exploitation of Remote Access Tools
These malicious activities often involve vishing tactics, tricking victims into granting remote access via legitimate monitoring tools like Quick Assist, AnyDesk, and TeamViewer. Attackers use this access for reconnaissance, payload delivery, and lateral movement within networks, ultimately exfiltrating data and deploying ransomware.
In some instances, attackers utilized Microsoft’s notes feature to avoid direct URL insertion, which would trigger security scans. They instruct victims to execute PowerShell commands to download and run malicious files, further compromising systems by extracting sensitive information via Active Directory queries.
Microsoft Teams’ external chat has emerged as a potent initial-access vector by exploiting user trust, rather than software vulnerabilities. This trend underscores the importance of robust endpoint and identity monitoring to detect and mitigate such sophisticated threats.
