Microsoft Teams vishing attacks lead to Chaos ransomware attacks
Summary
Attackers are using Microsoft Teams to impersonate IT support personnel and trick employees into granting remote access to their corporate devices. Once access is gained, the threat actors deploy the Chaos ransomware, targeting organizations primarily in North America.
IFF Assessment
This article describes a new attack vector and ransomware deployment, which is bad news for defenders.
Defender Context
Defenders should be aware of this social engineering tactic utilizing Microsoft Teams for impersonation. Training users to be vigilant about unsolicited IT support requests and verifying caller identity, even within internal communication platforms, is crucial. Implementing stronger multi-factor authentication and endpoint detection and response (EDR) solutions can help mitigate the impact of successful initial access.