Microsoft Teams: Social Engineering and Remote Access Abuse

Threat actors are conducting a wide-scale social engineering campaign by abusing Microsoft Teams' external chat functionality. The attack typically begins with "email bombing" to overwhelm the victim, followed by an external Teams message from an account impersonating "IT Support." Victims are persuaded to grant remote access via legitimate software, which attackers subsequently leverage to execute PowerShell payloads, steal credentials, and perform lateral movement.

Attack Chain

1. Preparation: Attackers initiate email bombing to create a sense of urgency for the victim.
2. Initial Contact: Attackers use external Teams chat to impersonate internal IT Support (often appending "(Internal)" to their display name).
3. Social Engineering: The attacker persuades the user to initiate a remote-access session using tools like Quick Assist, AnyDesk, or ScreenConnect.
4. Remote Access: The victim shares their screen, granting the attacker control over the endpoint.
5. Discovery: Attackers perform initial reconnaissance using commands such as whoami and systeminfo.
6. Payload Execution: Attackers deploy PowerShell-based payloads and establish a Command and Control (C2) beacon.
7. Persistence and Lateral Movement: Attackers utilize secondary remote access tools and abuse Kerberos mechanisms (e.g., Kerberoasting) to move laterally within the network.

Recommendation

• Monitor for Microsoft Teams ChatCreated events involving external participants, specifically those originating from unmanaged or consumer-grade accounts.
• Hardening: Disable the option allowing unmanaged users to start conversations with internal users.
• Hardening: Implement an allowlist for trusted external organizations and block federation with trial-only tenants.
• Training: Educate users on identifying the "External" tag in Teams and establishing standard procedures for how IT support initiates contact.