A Teams message from “IT Help Desk,” a quick call, and a request to open Quick Assist: that is all it takes for one hands-on-keyboard intrusion campaign to get inside a corporate network, according to Microsoft Threat Intelligence.
In research published Wednesday, Microsoft described attackers working from a separate Microsoft 365 tenant who contact employees through Teams external collaboration, pose as helpdesk staff and talk them into approving a “request control” prompt during a screen share or reading back a Quick Assist code. The lures vary, from “Microsoft Security Update” and “Spam Filter Update” to warnings that an account is about to be deactivated. Microsoft said the activity does not exploit a weakness in Teams. Users have to click past external-tenant labels, Accept/Block prompts and phishing indicators first.
From one remote session to the domain controllers
Once in control, the operator uses PowerShell to pull a malicious MSI from cloud storage and install it silently with msiexec. The installers carry update-themed names such as “devfix” or “Hotfix.” The package stages a portable copy of the legitimate Node.js runtime under the user’s LocalAppData folder and runs an encrypted JavaScript implant that polls its command server over HTTPS. Persistence comes from a Run key or Startup shortcut named EdgeUpdate.
From there the operators captured screenshots of the victim’s desktop, enumerated Active Directory users and servers through ADSI queries, ran extra DLL payloads through rundll32 and opened WinRM connections on TCP port 5985 to dozens of hosts, including domain controllers and certificate authorities. “The campaign follows a multi-stage attack chain that progresses from social engineering through payload delivery, execution, reconnaissance, and ultimately lateral movement,” the researchers wrote. Microsoft also found dormant code in the implant that could look up a new C2 address in an Ethereum smart contract, though that feature was switched off in the samples it analyzed.
Because nearly every step uses tools an enterprise already trusts, including Teams, remote support software, Windows Installer and Node.js, the activity blends into normal operations. Microsoft said the reconnaissance and WinRM pivoting are consistent with intrusions that come before data theft, extortion or ransomware.
Unit 42 tracked a similar operation
Palo Alto Networks’ Unit 42 documented a related pattern it calls Spring Ring. Between January and April, the operation approached more than 150 employees at at least 10 companies using 26 distinct external identities, with .onmicrosoft.com tenant names such as ITProtectionDepartment and MandatoryNetworkMonitoring. Many calls lasted only seconds or went unanswered, but successful ones typically ran 10 to 15 minutes, CyberPress reported.
Unit 42 saw two paths. In one, victims launched Quick Assist or another remote tool and the attacker downloaded an obfuscated PowerShell remote access trojan that beaconed to san-sid[.]com. In the other, a cloud-hosted file named after the victim’s company and username led to SMB scanning and an attempted NTLM relay against the domain controller using PetitPotam. Help Net Security reported that Unit 42 blocked both intrusion attempts.
The tactic has been around for a while. In April, Google’s Threat Intelligence Group described UNC6692, which flooded inboxes with spam and then offered “help” over Teams, steering victims to a fake mailbox repair page and a malicious Chromium extension called SnowBelt, The Register reported. Google said that campaign did not appear to be related to the activity Microsoft had flagged.
What Microsoft recommends
Microsoft’s guidance starts with treating any unsolicited external Teams chat or call from “IT” as suspicious and verifying it through a known internal channel before granting remote access. It also suggests limiting Teams external access to trusted domains, controlling which remote-assistance tools are allowed, enabling attack surface reduction rules against script-based staging, and restricting WinRM to authorized management workstations. Organizations that find signs of the campaign should assume network-level access and rotate any credentials reachable from the affected machine, including domain admin accounts.
WebProNews is an iEntry Publication