Many North American organizations have been targeted in a cyberattack that utilizes Microsoft Teams to spread ransomware.

Cybersecurity company, Sophos, reported on the trend, stating a threat group identified as STAC4749 has been initiating chats or calls via Teams and pretending to offer help desk or IT support.

This scam is meant to manipulate users into granting remote access because they think they are speaking to an actual, trusted help desk or support employee. To make their scam more realistic and legitimate, plausible employee usernames such as "AnthonyBrooks", "EthanParker", and "NicholasGrant" were used.

A remote access session is created using Microsoft Quick Assist or RemSupp tool. Then, the attackers deploy PowerShell to retrieve and execute malicious payloads from attacker-controlled servers.

Initially, the payload was a malware loader that performed system discovery, established persistence, and connected to a command-and-control server to retrieve a backdoor and additional payloads. Over time, the attackers switched from deploying the loader and instead used the remote access session to download the backdoor directly.

Analysts observed the scam calls ranged from 90 seconds to more than 20 minutes in length. Most calls lasted an average of 2.5 minutes.

The cybercriminals continually refined their deployment and evasion techniques, prioritizing speed and reliability to make data exfiltration and ransomware deployment smoother, according to Sophos. Data suggests that the criminals were actively testing or transitioning to new attack methods quickly, sometimes mid-attack.

Source: https://www.cybersecuritydive.com/news/hackers-microsoft-teams-ransomware-it-support/826591/; https://www.sophos.com/en-us/blog/chaos-in-teams-vishing

Commentary

This cyberattack scheme relies heavily on social engineering to trick unsuspecting users into allowing remote access to their devices.

Key facts about the scheme include that the attack is initiated on a trusted platform (Microsoft Teams), the attackers are impersonating helpdesk personnel using realistic usernames, and then users are asked to grant remote access.

Depending on department interaction or organization size, employees may not actually know or recognize their internal IT team members. A Teams call from a user with a convincing username and a confident IT support excuse may trick them into allowing remote access, causing ransomware to spread.

To help reduce the risks, organizations should begin by keeping all employees informed about who trusted IT staff or contractors are, including their verified and legitimate contact information. This step may give employees a helpful reference point if they are contacted by a scammer pretending to be an IT staffer not on the trusted list or a named IT staff member with conflicting contact information.

Well-informed staff may help stop the scam before it starts by being able to recognize who is a trusted IT professional, and who is not.

Additional steps to help avoid this new scam risk include:

· Requiring callback verification for all unexpected IT communications; staff must be required to contact IT through trusted channels after receiving any suspicious or unexpected communications

· A policy prohibiting the use of remote access sessions, allowing them only in specific circumstances

· A policy prohibiting credential sharing or multi-factor authentication workarounds

· Include IT impersonation schemes into all cybersecurity training to ensure staff are aware of the threat

The final takeaway is criminals are manipulating employees to permit device access. The best counter is training and continued education.