Attackers Exploit Microsoft Teams External Chats for Scaled Impersonation and Remote Access
Threat actors are leveraging a repeatable social engineering tactic involving email bombing and external Microsoft Teams chats to impersonate IT support and gain remote access to victim environments.
Threat actors are increasingly abusing Microsoft Teams' external chat functionality to compromise organizations at scale, employing a sophisticated social engineering pattern that combines email bombing with impersonation tactics. Arctic Wolf has detailed this recurring attack vector, observing it in over 400 incidents where attackers impersonate IT support to trick employees into granting them remote access.
The technique relies on the ability for external users to initiate chats with internal Teams users. Attackers exploit this by first inundating a victim's inbox with a flood of emails, often newsletters or subscription confirmations, to create a sense of urgency and distraction. This "email bombing" tactic is not new, having been previously observed in campaigns by ransomware groups like Black Basta, but its integration with Teams chat represents a significant evolution in social engineering.
Following the email bombardment, an external Teams user, posing as IT support, contacts the victim. This impersonator offers to resolve the email issue and persuades the employee to initiate a remote access session. Legitimate remote access tools such as Quick Assist, AnyDesk, ScreenConnect, and Zoho Assist are commonly used, lending an air of legitimacy to the request. The attackers often use display names like "IT Support (Internal)" to further mislead victims into believing the communication is internal.
Once the victim grants remote access, the attackers proceed with a series of post-exploitation activities. These typically include reconnaissance, credential theft, and the deployment of malware. A common sequence involves gathering system information, executing PowerShell-based payloads, establishing command-and-control channels, and performing lateral movement using techniques like Kerberoasting to escalate privileges. A second, commercial-grade remote access tool is often deployed to ensure a persistent and independent control channel.
Arctic Wolf's research highlights the recurring nature of this attack, noting the consistent use of specific throwaway tenants, display names, remote access tools, and payload domains. While definitive attribution remains challenging, "Black Basta-associated activity remains one of the most significant drivers of Teams chat abuse," according to Justin Moore, director of adversary operations at Arctic Wolf. The attackers have also shifted from using onmicrosoft.com tenants to attacker-controlled domains, particularly those ending in ".top".
Defenders can identify these attacks by monitoring for the "ChatCreated" event in Microsoft Teams telemetry, which signifies the initial one-on-one chat initiated by an external party. Arctic Wolf recommends several mitigation strategies, including allowing only trusted external organizations, blocking chats with unmanaged or consumer Teams accounts, disabling federation with trial-only tenants, and hardening remote access procedures. Educating users on how to identify external sender tags and report suspicious activity is also crucial.
Microsoft is also enhancing its defenses, with AI-powered phishing detection set to be introduced next month. This feature will leverage conversation context to identify phishing and social engineering attempts, especially in first-contact chats with external users. The ongoing evolution of this attack vector underscores the need for continuous vigilance and layered security approaches to protect against sophisticated social engineering campaigns.