Summary
Dark Reading reports on a wide-scale, ongoing social engineering campaign that combines email bombing with external Microsoft Teams chats to get malware onto a victim's machine in about 15 minutes. The activity may be tied to the Black Basta ransomware gang. The full article was not retrievable at time of writing, so details below are limited to the published summary and the well-documented pattern of this technique.
How This Pattern Works
- The target's inbox is flooded with spam subscriptions, creating a sense of urgency.
- An attacker contacts the target from an external tenant over Teams, posing as IT help desk staff offering to fix the problem.
- The victim is guided to start a remote-assistance session or run a command, which delivers the initial payload.
- The foothold is then used for credential theft, lateral movement, and potentially ransomware deployment.
Why It Matters
The approach is repeatable: it needs no exploit, and it abuses a default collaboration feature, external tenant messaging, that many organizations leave open. Speed leaves little time for detection between first contact and execution.
Recommendations
- Restrict external Teams access to an allow-list of trusted domains, or block unmanaged external chats.
- Block or tightly control remote-assistance tools such as Quick Assist for non-IT users.
- Alert on mailbox flooding events and on first-contact external Teams messages claiming to be IT support.
- Train staff that the real help desk will not initiate unsolicited chats asking for remote access.
- Verify any support request through a known internal channel before acting.