External Teams Chats Anchor 15-Minute Malware Delivery

Main bombing sis getting a new look with a wide-scale, ongoing social engineering campaign that might be tied to the Black Basta ransomware gang.

Threat actors are abusing Microsoft Teams’ external chat functionality at scale, using IT-support impersonation and email bombing tactics to trick employees into granting remote access. Attackers target multiple users within short, five-minute windows of time, and once the victim bites, the attack chain reaches payload execution in under 15 minutes.

In a blog post on Monday, Arctic Wolf detailed the campaign, and what it described as a “recurring social engineering pattern” across more than 400 incidents in the wild. Threat actors use Microsoft Teams’ external chat creation capability, which enables outside parties to contact employees.

“A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same ‘IT Support (Internal)’ display names, the same remote-access tools, and increasingly, the same payload domains,” Arctic Wolf’s Shubham Dubey wrote in the blog post.

In a typical example of the attack, the victim is “mail bombed,” or inundated with a flood of email subscriptions or newsletters, to establish a sense of urgency. Then, an external Teams user claiming to be IT support contacts the victim and offers to address the issue. The impersonator persuades the employee to launch a remote-access session via legitimate tooling like Quick Assist (most common), AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, and LogMeIn.

Once the victim grants access, the attacker conducts follow-on activity such as executing malware, stealing credentials, performing reconnaissance, or possibly deploying ransomware. Dubey explained that a typical order for this is a whoami/systeminfo-based recon, a PowerShell-based payload, a command-and-control (2) beacon, lateral movement to gain access to credentials through Kerberos abuse methods like Kerberoasting and GoldenPAC, and a second, commercial-grade remote access tool, “which provides an independent control channel that survives remediation of the original implant.”

Email Bombing Evolves to Deploy at Scale

Spam or mail bombing is not a new tactic. Threat actors have been flooding inboxes as a pretense for social engineering for some time now. Microsoft researchers identified the use of this technique by Black Basta in mid-2024, with later examples seen in 3AM, Cactus, Chaos, and the GoGRPC campaigns. But what stands out about Arctic Wolf’s research is that it shows this technique operating at scale, with recurring infrastructure, naming conventions, and attacker behavior seen across hundreds of incidents.

Justin Moore, director of adversary operations at Arctic Wolf, tells Dark Reading roughly 15% of cases progressed beyond the initial stage into a successful compromise, which, given the volume of the campaign, constitutes a success.

As for who is behind recent attack waves, Moore could not make definitive attributions but says, “Black Basta-associated activity remains one of the most significant drivers of Teams chat abuse.”

On the infrastructure front, Arctic Wolf noted a move from throwaway onmicrosoft.com tenants toward attacker-controlled domains, especially “.top” domains, and provided data on their prevalence. The vendor stated that approximately half of observed cases involving paid domains used .top domains.

For naming, attackers would reach out with “(Internal)” appended to the display name to trick the victim that a message is coming from within the company, even though Teams labels the sender as “external” simultaneously. The names will also frequently use friendly sounding names (Arctic Wolf offered Liam, Scott McGhee, and Matthew as examples) after labels like “IT Support” and “IT Service Desk.”

Other markers observed included naming conventions specific to the target’s locale (“Supporte TI” for French and Spanish speaking organizations), and the use of 100 different emoji in attacker display names.

Get Ahead of Email Bombing Social Engineering Attacks

Arctic Wolf noted that prior to engaging with victims, the attackers initiate a one-on-one chat to avoid group conversations, which Microsoft records in its telemetry as the ChatCreated event. Arctic Wolf assesses this to be the primary detection point for defenders setting alerts.

The vendor also recommended setting an allowlist for trusted external organizations, block chats with unmanaged or Teams consumer accounts, disable the option that lets unmanaged users start conversations with your users, block federation with trial-only tenants, and harden your remote access path.

In a nod to Cybersecurity Awareness Month, Arctic Wolf pointed out that it may also be wise to alert staff to the social engineering aspects behind these campaigns, including outlining exactly how IT reaches out, what these contacts look like (and what they do not look like), and to train users how to read the external sender tag in Teams to identify possible red flags. Microsoft Teams also includes end user reporting in the application itself.

That said, the technique could yet progress further.

“We have also recently observed campaigns combining Teams chat abuse with ClickFix-style social engineering, suggesting that the technique continues to evolve and is being integrated with other intrusion methods,” Moore says.

A Microsoft spokesperson tells Dark Reading that the company helps organization reduce the risk of phishing and social engineering in Teams through layered, built-in protections that, for example, can let administrators block external Teams users. The spokesperson adds that, next month, “Teams is introducing AI-powered phishing detection that uses conversation context to identify phishing and social engineering in higher-risk messaging scenarios, particularly first-contact chats with external users.”