ThreatRoundup
High

Inbox Flood, Then ‘IT’ on Teams: 400 Cases End in Remote Control

Arctic Wolf has seen more than 400 incidents where attackers mail-bomb a user, pose as IT on Microsoft Teams and get remote access via Quick Assist, a path to Black Basta, Cactus and Chaos ransomware.

ThreatRoundup · · 2 min read

Arctic Wolf says it has investigated more than 400 incidents in which attackers flooded an employee’s inbox, then reached out over Microsoft Teams posing as IT support and talked them into handing over remote control. In an Oct. 26 report, it says the attacker can go from first message to running code in under 15 minutes, and the technique has been used ahead of Black Basta, Cactus, 3AM and Chaos ransomware. The Hacker News covered the findings.

For defenders

The chain: A mail bomb buries the inbox in sign-up confirmations, T1667 (Email Bombing). A one-on-one chat then arrives from an external tenant with a name like “IT Service Desk (Internal)”, followed by a Teams call. The victim is talked into Quick Assist, or AnyDesk, ScreenConnect, TeamViewer and similar tools, T1219.002 (Remote Access Tools: Remote Desktop Software). The attacker opens the payload link during the session instead of pasting it into Teams, which keeps it away from Safe Links and ZAP. A second RMM tool (Level was seen) goes in via msiexec for persistence.

One case: A PowerShell command pulled an MSI from Azure Blob Storage, T1059.001 (Command and Scripting Interpreter: PowerShell). It dropped cleaner.ps1 and archive6.zip into AppData\Local\PowershellCleaner\scripts and launched a Python implant, ss.py, with pythonw.exe. The implant ran LDAP queries for every user and computer in Active Directory, T1087.002 (Account Discovery: Domain Account), and sent the results out. Arctic Wolf doesn’t tie its cases to a single named group.

Hunt: Arctic Wolf calls the external ChatCreated event its best early detection point. Watch for QuickAssist.exe or an unsanctioned RMM install shortly after a burst of subscription emails, and for pythonw.exe running out of AppData. Arctic Wolf published more than 40 domains; a sample:

Network
helpdeskteam365.onmicrosoft[.]com
itendpoint365.onmicrosoft[.]com
itcoreportal.onmicrosoft[.]com
itadmin922.onmicrosoft[.]com
corporateitservicellc.onmicrosoft[.]com
get-help-systems[.]top
helpdesk-sys[.]top
update-software[.]top
ms-system-check[.]top
itdeskassist[.]com

What it means for you

Here’s the pattern: your inbox suddenly fills with junk, and minutes later “IT” messages you on Teams offering to fix it. That’s the scam. Real IT teams rarely cold-message you from outside your company, and a Teams message from an outside organization is marked External. Never let someone you didn’t contact yourself take control of your screen. We’ve seen the same trick deliver EtherRAT.

Do this now

  1. Teams admins: switch external access from “allow all” to an allow-list of partner domains, and block trial tenants with Set-CsTenantFederationConfiguration -ExternalAccessWithTrialTenants "Blocked".
  2. Remove Quick Assist where it isn’t used, and block remote-access tools your IT team didn’t approve.
  3. Tell staff how your real IT team contacts them, and require a call-back to a known number before anyone grants remote access.
  4. If an “IT” session already happened, disconnect the PC from the network and call your real IT team or provider right away.

More from the Roundup