Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
Summary
Threat actors are exploiting Microsoft Teams' external chat feature to conduct impersonation scams and deploy malware and ransomware. Researchers have observed a recurring pattern of attackers using throwaway tenants to facilitate these attacks, which often involve impersonating IT support personnel.
IFF Assessment
This article describes a new attack vector that threat actors are using to distribute malware and ransomware, posing a direct threat to organizations.
Defender Context
Defenders should be aware of social engineering tactics leveraging Microsoft Teams' external chat functionality. Organizations need to educate users about these impersonation scams and consider implementing stricter controls or monitoring for suspicious external communication patterns within Teams.