Overview
Ransomware groups are employing a sophisticated attack chain combining email bombing with Microsoft Teams social engineering to compromise corporate networks. The attacks leverage default Teams configurations that allow external domain communications and exploit remote assistance tools
Whom it may concern
- IT Security Teams
- Microsoft 365 Administrators
- End User Support Teams
- Risk Management
Key Findings
- Attackers send 3,000+ spam emails in 45 minutes to overwhelm targets
- Threat actors impersonate IT support using legitimate Office 365 instances
- Malware deployment occurs through side-loading into legitimate processes
- Multiple ransomware groups including Black Basta and potential FIN7 affiliates involved
Risk Analysis
- Probability: High (8/10)
- Impact: Critical (9/10)
- Attack Surface: Microsoft Teams, Quick Assist, PowerShell
- Data Risk: Credential theft and network lateral movement
Action Items
- Block external Teams communications by default
- Disable Quick Assist on critical systems
- Implement strict PowerShell controls
- Deploy network segmentation for critical assets
- Enhance security awareness training
Sources
- [Bleeping Computer](https://www.bleepingcomputer.com/news/security/ransomware-gangs-pose-as-it-support-in-microsoft-teams-phishing-attacks/)
