Fake IT-support Teams external chats used in 400+ intrusions for RMM access, GoGRPC backdoor and Chaos ransomware (Arctic Wolf)

Linha do tempo

1. digit.fyi ↗ · pub. 28/10/2026 10:16 · coletado 28/10 12:00

   Threat actors abuse Microsoft Teams external chat to impersonate IT support and execute payloads within 15 minutes

   ler a análise desta fonte ocultar

   Arctic Wolf documented more than 400 incidents in which attackers abused Microsoft Teams external chat to pose as internal IT support and gain access to corporate networks. Attackers first flood a target's inbox with hundreds of spam emails, then contact the employee on Teams offering to fix the problem. Payload execution was observed in under 15 minutes after the victim engaged with the first message. The technique exploits no software vulnerability and relies on abuse of legitimate features and employee trust. The findings were released alongside Arctic Wolf's 2026 Agentic Security Operations Report.

   Technical Details

   • Initial contact: email bombing followed by a Teams external chat message from accounts with convincing helpdesk-style display names.
   • Victims are persuaded to start legitimate remote-support software such as Microsoft Quick Assist, which lets attackers run malicious code, steal credentials or establish persistence.
   • Several employees at the same organisation were targeted within minutes of each other, which suggests automation.
   • The article names no malware families, IOCs or threat actors.

   Remediation

   • Restrict Teams external communication to trusted domains.
   • Limit access to remote-support tools.
   • Establish independent verification procedures for unexpected IT support requests.
   • Monitor collaboration platforms, endpoints and identity systems for suspicious activity.
2. infosecurity-magazine.com ↗ · pub. 27/10/2026 09:30 · coletado 27/10 11:01

   Attackers abuse Microsoft Teams external chat for IT-support impersonation, with payload execution in under 15 minutes

   ler a análise desta fonte ocultar

   Arctic Wolf reports more than 400 incidents in which threat actors abused Microsoft Teams external chat to gain initial access to organizations. The actors impersonated IT support, and payload execution came less than 15 minutes after a victim engaged with the first message. Targeting of multiple victims within short windows suggests automation. Arctic Wolf did not identify the perpetrators, but noted that ransomware groups such as Black Basta have used external Teams chat as an initial access vector.

   Technical Details

   • Teams external access is enabled by default, so any user in another Microsoft 365 tenant can find, chat with and call employees when both tenants allow external access.
   • Attackers used newly created or acquired Microsoft 365 tenants. In 30-40% of cases these were default onmicrosoft[.]com domains, which need no verification and can be provisioned within minutes.
   • Tenant names used support-, IT-, admin-, network- or helpdesk-themed words, sometimes suffixed with "365". Display names such as "IT Service Desk – Liam" mimicked real service desk staff. A few cases embedded legitimate company names in the tenant name.
   • In a significant number of cases, the target's mailbox was flooded with hundreds of newsletter or subscription confirmations within minutes (email bombing). The attacker then messaged on Teams offering to fix the problem they had just caused.
   • The next step was usually hands-on-keyboard access through Quick Assist, which is built into Windows. For persistence, attackers moved to commercial RMM tools such as AnyDesk and ScreenConnect.
   • RMM access enabled execution of a PowerShell payload and lateral movement, potentially for ransomware. In some cases the victim was told to run the PowerShell command and launch the downloaded file.

   Remediation

   • In Teams admin center → Users → External access, select 'Allow only specific external domains' and list only active partner domains.
   • Block chat with unmanaged/consumer Teams accounts and disable the option that lets unmanaged users start conversations.
   • Block federation with trial-only tenants.
   • Enable 'Allow my security team to manage blocked domains' so the security team can push blocks.
   • Restrict Quick Assist to authorized IT roles and block or uninstall unsanctioned RMM tools.
   • Train staff on how genuine IT support makes contact, how to read the External tag and the real sender domain, and how to use Teams' end-user reporting for suspicious messages.
3. gbhackers.com ↗ · pub. 27/10/2026 04:36 · coletado 27/10 05:00

   Fake Microsoft Teams IT Support Chats Used to Gain Remote Access and Deploy Malware in 400+ Incidents

   ler a análise desta fonte ocultar

   Arctic Wolf Labs reports more than 400 incidents in which attackers abused Microsoft Teams external chats to pose as IT support, obtain remote access and deliver malware. The activity relies on Teams federation, which is enabled by default, and exploits user trust rather than a software vulnerability. Many intrusions begin with email bombing, followed by a Teams message or voice call from supposed support staff. At least three investigated compromises ended in ransomware encryption, although the article does not establish that all observed activity shares one operator. Customer-reported attack chains reached payload execution in under 15 minutes.

   Technical Details

   • Attackers append "(Internal)" to display names such as "IT Support" to offset Teams' external-user warning. Some identities include the target organization's name or domain.
   • Between 30 and 40 percent of cases used default onmicrosoft[.]com domains. Among paid-domain cases, about half used .top, about 40 percent .com, and just over five percent multilevel domains.
   • Victims are guided into a Teams voice call and asked to grant remote access. Quick Assist was the most frequently observed tool, alongside AnyDesk, ScreenConnect, TeamViewer and Atera. Commercial remote management software can provide persistence independent of the original session.
   • Attackers contacted multiple employees within roughly five-minute windows, behavior Arctic Wolf assessed as likely automated.
   • Microsoft previously documented the email bombing plus Teams sequence in Storm-1811 operations tied to Black Basta ransomware. Sophos research on STAC4749 documented IT-themed .top identities, Teams vishing and remote access preceding Chaos ransomware.
   • In one Arctic Wolf case, the victim was persuaded to run PowerShell and launch an MSI downloaded from Azure Blob Storage. The MSI bundled cleaner.ps1 and archive6.zip. The script decoded hexadecimal content, decrypted an AES-protected payload, verified its hash and executed the PowerShell through ScriptBlock. The next stage extracted pythonw.exe and ss.py and launched an implant. A later MSI transaction issued LDAP queries against Active Directory, enumerating computer and user objects. The implant sent account names and descriptions to C2 endpoints chosen from embedded lists.

   Remediation

   • Use the Teams ChatCreated event as an early detection point, before the recipient responds.
   • Correlate suspicious external chats with inbox floods, remote-tool execution, PowerShell activity and identity alerts.
   • Restrict unnecessary federation and control which support software is approved.
   • Require employees to verify unexpected helpdesk requests through established internal channels before granting access or running commands.
4. thehackernews.com ↗ · pub. 26/10/2026 12:52 · coletado 26/10 15:00 primeiro registro

   Threat actors abuse Microsoft Teams external chats to pose as IT support, deploy RMM tools, GoGRPC backdoor and Chaos ransomware

   ler a análise desta fonte ocultar

   Arctic Wolf Labs reports a recurring social engineering pattern across hundreds of cases in which threat actors abuse the external chat feature in Microsoft Teams to impersonate IT support and gain remote access. Messages come from throwaway Microsoft 365 tenants with names such as "IT Support (Internal)" and typically follow an email-bombing wave that creates urgency. The activity aligns with STAC4749, which Sophos has linked to Chaos ransomware deployments. Victims are talked into granting hands-on-keyboard access through legitimate RMM tools, which leads to reconnaissance, backdoor deployment, lateral movement to domain controllers, data exfiltration and, in some cases, ransomware.

   Technical Details

   • About 30-40% of cases use *.onmicrosoft[.]com fallback tenant domains with help desk-themed names (e.g. helpdeskteam365.onmicrosoft[.]com, itendpoint365.onmicrosoft[.]com, itcoreportal.onmicrosoft[.]com, itadmin922.onmicrosoft[.]com, corporateitservicellc.onmicrosoft[.]com).
   • Attackers are shifting to paid TLDs for tenant creation: roughly 50% use .top, about 40% .com, and just over 5% multi-level domains such as .com.pl, .com.vn and .com.br.
   • Display names include "IT Service Desk – Liam", "IT Support – Christopher Thomas" and "Enterprise IT & Security (Internal)"; recent iterations embed the target organization's name.
   • Targets are organizations with external Teams access enabled. Vishing is used to obtain remote sessions via Quick Assist, AnyDesk, ScreenConnect, TeamViewer, Atera, Zoho Assist, NetSupport and LogMeIn.
   • Post-access activity includes reconnaissance, the GoGRPC backdoor, lateral movement to domain controllers, additional RMM tools such as Level for redundancy, data exfiltration and ransomware execution.
   • Attackers avoid pasting URLs into Teams to bypass Safe Links / ZAP scanning, instead navigating to payloads during the remote session. In a subset of cases they used Microsoft's notes.
   • In one case the victim ran a PowerShell command that downloaded an MSI from Azure Blob Storage. The installer launched a PowerShell script that extracted and ran an embedded Python implant, which issued LDAP queries to Active Directory for all computer and user objects and sent the results to an external server.
   • Arctic Wolf stresses that the vector exploits trust rather than a software vulnerability.

   Remediation

   • Restrict or disable Teams external access, or allow-list trusted tenants only.
   • Monitor endpoint and identity telemetry in addition to message scanning, since payloads are not delivered as links in chat.
   • Alert on newly seen external tenants, *.onmicrosoft[.]com and .top domains, and on unsanctioned RMM tool installation.
   • Train users to treat unsolicited IT support contact, especially after email floods, as suspicious and to verify through a separate channel.