Recurring Cybersecurity Threats Exploiting Microsoft Teams
Cybersecurity researchers are increasingly highlighting a significant and alarming trend in cybercriminal behavior, particularly involving the misuse of Microsoft Teams. Arctic Wolf Labs, a cybersecurity firm, has identified a “recurring social engineering pattern” that has emerged across numerous cases. This pattern reveals how threat actors are exploiting Teams’ external chat creation feature to execute impersonation scams and disseminate malware effectively.
The report shared with The Hacker News emphasizes a consistent methodology among attackers. They utilize disposable accounts created under the guise of legitimate IT support services, employing familiar and appealing display names to avoid suspicion. The tactics of these criminals have evolved, incorporating both familiar terminology and specific technologies to enhance the credibility of their schemes. The names used for these impersonations often include IT-themed terms or friendly first names designed to bypass external-user warnings in Microsoft Teams communications. By posing as credible IT personnel, these criminals have successfully engaged potential victims in various incidents.
Arctic Wolf has reported that nearly 30-40% of the investigated cases leveraged the .onmicrosoft.com domains, which are automatically generated by Microsoft during the creation of a new Microsoft 365 tenant. By choosing tenant names that include help desk or support-related terminology, such as “helpdeskteam365.onmicrosoft.com” and “itendpoint365.onmicrosoft.com,” attackers further increase their perceived legitimacy.
Moreover, prior to initiating communication on Teams, these attackers often resort to a tactic known as mail bombing. This technique involves flooding the victim’s inbox with a barrage of subscription confirmations or other emails designed to create a false sense of urgency. Following this deluge of emails, the attackers then swoop in with a seemingly supportive message from an IT expert, purporting to resolve the "issues" caused by the earlier email assault.
Arctic Wolf’s report lists several display names observed across various cases, underlining the consistent themes employed by these attackers. Names such as "Help Desk," "IT Support," and "IT Service Desk – Liam" are some of the identities that have emerged in these phishing attempts. In more recent iterations, attackers have even incorporated real company domains into their display names, enhancing the credibility of the communications and making it even more challenging for victims to recognize the threat.
One notable shift reported involves the increasing use of paid top-level domains (TLDs) for creating these malicious tenants. In the past few months, it was noted that approximately 50% of these fraudulent identities employed the .top TLD, while around 40% utilized standard .com domains. Attackers are adapting their strategies, often using more sophisticated domain choices to bolster the trustworthiness of their communications.
The tactics employed mirror those of a known threat group identified as STAC4749, notorious for creating IT-themed cloud domains under the ".top" TLD. These attackers have previously been linked to the deployment of Chaos ransomware, indicating a broader trend towards increasingly harmful intentions in these operations.
The focus of these attacks is often on organizations with external access enabled, involving a technique known as “vishing.” This method encourages victims to unwittingly grant the attackers hands-on access through legitimate remote monitoring and management tools like Quick Assist, AnyDesk, and TeamViewer.
Once inside the system, these attackers conduct reconnaissance, deploy additional malicious payloads, and often facilitate lateral movement through the network to high-value targets such as domain controllers. Data can then be exfiltrated, and ransomware can be deployed.
In certain instances, attackers have been observed utilizing Microsoft’s Notes application during these interactions. By avoiding direct URL pasting into Teams, which could trigger protective scanning measures, they navigate to malicious files during remote sessions instead. This strategy emphasizes the importance of comprehensive endpoint monitoring, as well as message scanning, to detect these evolving threats.
One case highlighted within the report described an attacker instructing a victim to execute a PowerShell command to download a file. This file, when executed, initiated a PowerShell script designed to extract and transmit sensitive data back to the attacker’s external server.
According to Arctic Wolf, “External Microsoft Teams chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability.” Attackers combine various tactics, such as email bombardment, IT-support impersonation, and social engineering techniques, to lead victims from what appears to be a routine conversation into a realm of remote access and severe data breaches.
As organizations navigate this evolving landscape, continual vigilance and updated cybersecurity measures are essential in combating these sophisticated threats. Understanding the patterns and tactics employed by these attackers will be crucial in developing robust defenses and safeguarding sensitive information.