Microsoft Teams vishing attacks trick employees into handing over remote access – Source: www.csoonline.com

Attackers believed to be affiliated with ransomware groups have recently been observed using a technique in which they bombard employees with spam emails and then call them on Microsoft Teams posing as technical support representatives from their organizations.

The goal of this formerly uncovered social engineering tactic is to create a sense of urgency and trick employees into granting them remote access to their work computers. Incident responders from security vendor Sophos said in a report that they had detected two different groups engaging in such attack campaigns since November, following more or less the same playbook.

“Sophos is tracking these threats as STAC5143 and STAC5777,” the company said. “Both threat actors operated their own Microsoft Office 365 service tenants as part of their attacks and took advantage of a default Microsoft Teams configuration that permits users on external domains to initiate chats or meetings with internal users.”

The company notes that STAC5777 overlaps with a group that Microsoft tracks as Storm-1811 and has been engaged in similar Teams-based voice phishing (vishing) attacks since May 2024. At the time, the group was observed distributing the Black Basta ransomware, which is also the case in the new attacks observed by Sophos.

Meanwhile, STAC5143 uses malware payloads very similar to those previously associated with a cybercriminal group known in the industry as FIN7 or Carbon Spider. FIN7 has been around for at least 10 years and has been involved in many types of attacks and has links to many ransomware operations including REvil, Lockbit, Darkside, and Black Basta.

Attack employs an email bombing campaign followed by vishing

In both cases, the attackers chose employees from organizations with Microsoft 365 subscriptions as targets to ensure they used Microsoft Teams for work. In order to generate a sense that something was wrong that would lend credence to their social engineering tactic, the attackers first bombarded the targeted employees with thousands of spam emails in a short amount of time.

They then voice- or video-called those employees via Teams from external accounts that were set up on other Microsoft 365 tenants controlled by attackers. The attackers then posed as members of the IT team of the employee’s organization and used accounts with names such as Help Desk Manager.

An external call might not necessarily set off red flags with employees, especially in organizations that use managed service providers (MSPs) for IT management, the Sophos researchers said.

The STAC5143 attackers asked victims to allow a remote screen control session via Teams’s built-in function and then proceeded to execute shell commands and download malware from an external SharePoint file store.

The STAC5777 attackers took a slightly different route, by guiding the victims into installing Microsoft Quick Assist, a separate Microsoft tool based on the remote desktop protocol (RDP). They then connected using the tool and used a browser to download malicious payloads from a subdomain of blob.core.windows.net, which is associated with the Microsoft Azure file storage service.

It’s worth noting that in both cases the attackers used domains associated with Microsoft services for malicious file distribution, which is less likely to raise alerts in network monitoring products.

Attackers follow up by exploiting backdoors and deploying ransomware

The first stage of the STAC5143 attack chain involved a Java archive (JAR) file and a .zip archive containing Python code. The attackers executed the JAR file from the command line with a headless copy of the Java runtime that would run in the background and wouldn’t show any output.

The Java code was designed to execute PowerShell commands that in turn downloaded the 7-Zip archive manager and a .7z archive. The archive contained a copy of the ProtonVPN executable along with a malicious DLL that the executable automatically side-loaded when executed.

The ProtonVPN program was used to set up VPN connections to servers in Russia, the Netherlands and the US. Meanwhile, the JAR file executed a second JAR file which in turn unpacked the original zip and executed the Python scripts inside which were designed to act as backdoors. These Python backdoors were previously seen in attacks attributed to FIN7.

In addition, the attackers used built-in Windows commands to determine the employee’s username and the network resources they had access to and then performed additional network discovery.

The STAC5777 attack chain was more involved, with more hands-on-keyboard hacking and commands. During the first stage, the attacker used the browser to download two .dat files, which they then combined into an archive called pack.zip.

The archive contained multiple files, including a legitimate executable called OneDriveStandaloneUpdater.exe, two .dll files from the OpenSSL Toolkit project, an unknown winhttp.dll,and a file called settingsbackup.dat. The archive and files were unpacked in a folder called OneDriveUpdate under the Windows AppData directory.

Malware was capable of stealing system info and recording keystrokes

The winhttp.dll file was a backdoor that was automatically sideloaded by the legitimate OneDrive executable. The file was capable of gathering system information, including configuration details, the name of the current user, and recording keystrokes. The researchers also believe it was meant to decrypt the settingsbackup.dat and execute it as a second-stage payload, but they did not manage to analyze this file.

The attackers also set up persistence by creating a service to execute the OneDrive updater and then used the victim’s credentials to try to access other systems, looking for domain access. The techniques varied from victim to victim. In one case they used the victim’s VPN credentials to establish a remote connection and then try to access other systems via RDP. In another, they used Windows Remote Management (WinRM) to perform lateral movement.

The attackers also searched for text and Word files that had the word password in their names, inspected locally stored .rdp files for configuration data and even accessed a network diagram. In one case confirmed by Sophos, the attackers deployed the Black Basta ransomware.

Mitigating spam-and-vishing attacks

The Sophos report included indicators of compromise and TTPs that can be used to build detection rules. However, the company advised organizations to train their users to identify and avoid these social engineering tactics.

“Employees should be aware of who their actual technical support team is and be mindful of tactics intended to create a sense of urgency that these sorts of social-engineering-driven attacks depend upon,” the researchers said.

In addition, companies should restrict Teams calls from outside the organization in their Microsoft 365 subscription or limit them to trusted partners. Remote access applications that are not used by the organization’s IT support team should be restricted on employee computers.