Fake IT support in Microsoft Teams: how attackers get from a chat to running code in under 15 minutes
Arctic Wolf has tracked more than 400 incidents in which attackers used Teams external chat to pose as the help desk. The setting that lets them in is on by default.
Attackers are using the external chat feature in Microsoft Teams to pose as IT support and talk staff into handing over access, according to research from the security firm Arctic Wolf reported by Infosecurity Magazine on 27 October. Arctic Wolf says it observed more than 400 incidents with highly consistent IT support impersonation tactics, and that the attack reached payload execution in under 15 minutes from the moment a victim engaged with the first message.
Why Teams
Teams external access is turned on by default, which means any Teams user in another Microsoft 365 tenant can find, chat with and call your staff, provided both organisations allow external access. Arctic Wolf found the attackers set up their own tenants for the purpose. Between 30 and 40 per cent of cases used default onmicrosoft.com domains, which need no verification and can be created within minutes. The tenant names were typically built around words such as support, IT, admin, network or helpdesk, sometimes with 365 on the end, and the senders used fake first names alongside a service desk label so they looked like a colleague on the help desk.
How the attack runs
In a significant number of cases the target's inbox was first flooded with hundreds of newsletter and subscription confirmations within minutes, a tactic known as mail bombing. Moments later a Teams message arrived from IT support offering to fix the very problem the attacker had just created. The next step was usually to get remote control of the computer through a legitimate tool, most often Quick Assist, which is built into Windows and needs no installation. Where the attackers wanted to stay longer they moved to commercial remote access tools such as AnyDesk and ScreenConnect, which can be used to run PowerShell and move across the network. In some cases the user was told to run the command themselves. Arctic Wolf did not identify who was behind the attacks, but notes that ransomware groups including Black Basta have used Teams external chat to get in.
What Arctic Wolf recommends
Arctic Wolf's recommendations start in the Teams admin center: under external access, allow only the specific external domains your organisation actually works with. Block chat with unmanaged and consumer Teams accounts, and turn off the option that lets unmanaged users start conversations with your staff. Block federation with trial only tenants, which attackers favour because they take so little to set up. Restrict Quick Assist to authorised IT staff and remove remote access tools you have not approved. And tell staff exactly how your real IT support gets in touch, teach them to read the External label and the sender's real domain, and show them how to report a suspicious message or external user in Teams.
What this means for your business
If nobody has changed your Teams external access setting, it is still on its default, which lets users in other Microsoft 365 organisations that also allow external access find and message your staff. Ask whoever manages your Microsoft 365 to look at it this week: if you only chat with a handful of customers and suppliers in Teams, limit external access to their domains. Then make the human rule plain to everyone. Tell your team how your IT support will actually contact them, and that a Teams message from an unfamiliar External account offering to fix a problem is a reason to stop and ring IT on a number they already know, never a reason to open Quick Assist. A sudden flood of sign up emails followed by a helpful message is the pattern to watch for. If you are in Exeter or the wider South West and want your Teams and Microsoft 365 settings reviewed, talk to us.
#WEARECOBALT
Ready when you are.
Tell us what's slowing your business down. We'll tell you exactly how we'd fix it — plainly, with no obligation.