Cyber attackers have found a new way to breach systems by impersonating IT support staff on Microsoft Teams. This alarming method allows them to gain control over employees’ Windows PCs without needing to exploit software vulnerabilities or obtain passwords.
Deceptive Tactics on Microsoft Teams
The attack begins with cybercriminals posing as IT technicians, utilizing external Microsoft Teams contacts to establish trust with their targets. By persuading employees to use Windows Quick Assist, attackers gain entry to the victim’s system. Once access is granted, they can download malicious software without raising immediate suspicion.
Unit 42 analysts describe this as a sophisticated blend of social engineering and remote-control abuse. Their report highlights the significant threat posed by these operations, which exploit commonly used tools and services within organizations.
Technical Methodology of the Attack
Once attackers secure a remote session, they download an MSI installer from an Amazon S3 location, disguised as a routine software update. This installer includes both legitimate and harmful components, a tactic that lowers the victim’s defenses. The malicious components are activated through DLL sideloading, a method where legitimate-looking applications execute malicious code.
This process involves loading a harmful DLL, which then connects to an AWS API Gateway endpoint, allowing attackers to mask command traffic within normal cloud service activities. This technique evades detection by appearing as standard application behavior.
Preventative Measures and Recommendations
Organizations must be vigilant in monitoring Teams communications from external sources. Employees should be trained to verify any unexpected IT support requests through known channels rather than following unsolicited instructions.
Security teams should keep an eye out for applications that load unsigned DLLs from their directories and investigate any unusual remote sessions. Additionally, they need to scrutinize outbound encrypted connections from trusted programs to prevent unauthorized access.
By implementing these measures, businesses can better protect themselves from these advanced cyber threats and safeguard valuable data and systems from unauthorized intrusions.
