Threat Actors Impersonate IT Support via Teams to Gain Enterprise-Wide Access
Attackers are impersonating IT support on Microsoft Teams to trick users into granting remote access, leading to enterprise-wide compromise.
Microsoft Threat Intelligence has identified a sophisticated human-operated intrusion campaign that leverages Microsoft Teams' external collaboration features to impersonate IT or helpdesk personnel. Threat actors initiate contact through Teams, aiming to socially engineer users into granting them interactive remote sessions. This tactic bypasses traditional email-based phishing defenses by appearing as legitimate IT support, making users more likely to grant access.
Once remote control is established, often through legitimate remote monitoring and management (RMM) tools, the attackers deploy a malicious Node.js implant. This is achieved by using PowerShell to download and silently install a malicious MSI package, which then stages a portable Node.js runtime and an obfuscated JavaScript implant. This implant provides persistent command execution and command and control (C2) capabilities, allowing the attackers to operate undetected.
Unlike simpler attacks that might end with credential theft, this campaign follows a comprehensive hands-on-keyboard playbook. After the implant is deployed, the threat actor conducts extensive reconnaissance of both the host system and the Active Directory environment. They periodically capture screenshots of the victim's desktop, execute further payloads using trusted Windows binaries, and move laterally across the enterprise network.
The lateral movement is primarily achieved using Windows Remote Management (WinRM), targeting high-value assets such as domain controllers. This allows attackers to map the network, escalate privileges, disable security controls, exfiltrate sensitive business data, and ultimately deploy ransomware across the organization. The reliance on legitimate tools like Microsoft Teams, RMM software, Windows Installer, Node.js, and native administrative protocols allows the malicious activity to blend seamlessly with normal enterprise operations.
The attack chain begins with the threat actor initiating a Teams chat or call from an external tenant, impersonating IT staff. They then coax the user into granting remote control, either by approving a "request control" prompt during a Teams screen share or by providing a connection code for tools like Quick Assist. This initial access method, classified under T1566.003 (Spearphishing via Service), capitalizes on user trust in internal support channels.
During the remote session, PowerShell is used to download and install a malicious MSI package. This package sets up a script-based loader and an encrypted implant, often downloading a portable Node.js runtime if not already present. The loader decrypts and executes the JavaScript implant, which then establishes randomized HTTPS polling for C2 communication. Observed tasks include host reconnaissance, security product discovery, and screen captures.
Further stages involve domain enumeration using native tools and Active Directory Service Interfaces (ADSI) queries. Additional payloads are executed via rundll32, and lateral movement is facilitated through WinRM connections to other domain-joined systems, including critical infrastructure like domain controllers and certificate authorities. This comprehensive approach allows attackers to gain deep access and control over an entire enterprise network.
Microsoft recommends defenders implement specific mitigation and hunting guidance to detect and disrupt this attack pathway. This includes monitoring for suspicious Teams external collaboration activity, unusual RMM tool usage, and lateral movement via WinRM. By understanding this attack chain, organizations can better defend against sophisticated threats that leverage legitimate tools for malicious purposes.