Cybersecurity researchers are calling attention to what they say is a “recurring social engineering pattern” across hundreds of cases in which threat actors use Microsoft Teams’ external chat creation feature to conduct impersonation scams or to deliver malware.
“A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same ‘IT Support (Internal)’ display names, the same remote-access tools, and increasingly, the same payload domains,” Arctic Wolf Labs said in a report shared with The Hacker News.
The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.
Nearly 30–40% of the cases investigated by the cybersecurity company involve the use of *.onmicrosoft[.]com, a permanent fallback domain automatically generated by Microsoft when a Microsoft 365 tenant is created. These domains masquerade as IT infrastructure, opting for a help desk- or support-themed word as the tenant name to increase their credibility –
- helpdeskteam365.onmicrosoft[.]com
- itendpoint365.onmicrosoft[.]com
- itcoreportal.onmicrosoft[.]com
- itadmin922.onmicrosoft[.]com
- corporateitservicellc.onmicrosoft[.]com
As observed in many cases before, these Teams sessions are preceded by mail bombing, where the victim’s inbox is flooded with hundreds of newsletter or subscription confirmations in a short span of time. The approach is designed to induce a false sense of urgency, with the Teams IT support message arriving soon after to help resolve the problem.
Some of the display names observed by Arctic Wolf across different cases are listed below –
- Help Desk
- IT Support
- HelpDesk Manager
- IT Service Desk – Liam / IT Service Desk (Liam)
- IT Service Desk – Matt / IT Service Desk – Scott
- IT Support – Christopher Thomas
- HelpDesk Supervisor
- Enterprise IT & Security (Internal)
- IT Tech Support Internal
- Business IT Solutions & Support (Internal)
- Maintenance Service
- IT-Representative
- IT/Help Desk
In recent iterations, the attackers have been observed adding the target organization’s domain or company name in their display name to lend the messages additional legitimacy.
“We also observed a recent shift toward paid top-level domains (TLDs) for tenant creation,” Arctic Wolf said. “Of the paid domains we identified in these types of scams over the past few months, approximately 50 percent of fake identities used the .top TLD, around 40 percent used a standard .com domain, and just over five percent used multi-level domains such as .com.pl, .com.vn, and .com.br.”
The activity aligns with that of STAC4749, has a history of creating IT-themed cloud domains under the “.top” TLD and leveraging plausible employee usernames to make the accounts appear authentic. These attacks have led to the deployment of Chaos ransomware, according to Sophos.
The attacks specifically go after organizations where external access is enabled. This also involves an element of vishing to trick victims to granting them hands-on-keyboard access through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.
The remote access is abused to conduct reconnaissance, deliver additional payloads like the GoGRPC backdoor, facilitate lateral movement to domain controllers, and deploy additional RMM tools like Level for redundancy, before exfiltrating sensitive data and dropping the ransomware binary.
“In a subset of cases, attackers leveraged Microsoft’s notes,” Arctic Wolf said. “Attackers generally avoid pasting a URL directly into Teams, which would trigger Safe Links / ZAP scanning, and instead navigate to the payload themselves during the remote session. Consequently, endpoint and identity telemetry are essential monitoring surfaces alongside message scanning.’
In one case identified by the cybersecurity vendor, the threat actor is said to have instructed the user to run a PowerShell command to download a file and then launch it. The PowerShell command is designed to download an MSI installer from Microsoft Azure Blob Storage.
When the victim runs the installer, it launches a PowerShell script responsible for extracting and executing a Python implant embedded within it. The backdoor then runs another MSI transaction that issues LDAP queries to Active Directory for all computer and user objects and then transmits the information to an external server.
“External Microsoft Teams chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability,” Arctic Wolf said.
“Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise.”