[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsxwmH28UO_dGPaErt-CHBud2rKvKg_3Kszm9tnkxAt8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"b8778c8d-b8f6-4c8a-9ace-7f261c61840b","teams-it-support-impersonation-scams-deliver-ransomware-via-trusted-remote-access-tools","f310d796-f2dc-4764-ac90-16c221fc8663","Teams IT Support Impersonation Scams Deliver Ransomware via Trusted Remote Access Tools","Threat actors are exploiting Microsoft Teams' external chat functionality to impersonate IT support personnel, first overwhelming users with mail bombs to manufacture urgency, then convincing them to grant remote access via legitimate RMM tools. Because the attackers use real Microsoft 365 tenants with convincing IT-themed display names, users have little technical signal to distinguish the scam from genuine helpdesk contact. Once remote access is granted, attackers deploy ransomware, backdoors, and conduct lateral movement — all under the cover of trusted software. This campaign highlights how social engineering can completely bypass technical controls when users are not trained to verify identity through out-of-band channels. The widespread enablement of external Teams access without compensating controls creates a large, exploitable attack surface.","**Immediate actions:**\n- Restrict or disable Microsoft Teams external access from unknown\u002Funmanaged tenants via the Teams Admin Center, allowing only verified partner domains.\n- Train users to never grant remote access to anyone who initiates contact through chat alone — always require verification through a known, internal IT ticketing or callback process.\n- Block or alert on RMM tools (e.g., AnyDesk, ScreenConnect) that are not sanctioned by the organization at the endpoint and network level.\n\n**Long-term improvements:**\n- Implement a formal IT support identity verification policy requiring multi-step out-of-band confirmation before any remote session is permitted.\n- Enforce Conditional Access policies and privileged access workstations so that even a compromised session has limited lateral movement capability.\n- Maintain an allowlist of approved communication channels and remote access tools, and auto-block all others via endpoint policy.\n\n**Detection measures:**\n- Deploy SIEM alerting for unusual RMM tool installations or executions, especially those initiated outside of change windows or by non-IT user accounts.\n- Monitor Microsoft Teams logs for inbound external chat messages referencing IT support, credentials, or remote access requests and route them to the SOC for review.\n- Enable mail flow anomaly detection to flag mail bombing patterns as a leading indicator of a follow-on social engineering attempt.",[12,13,14,15,16,17,18],"CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","NIS2 Article 21(2)(b)","CIS Control 4: Secure Configuration of Enterprise Assets and Software",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":22,"CIS Control 17: Incident Response Management":23,"CIS Control 14: Security Awareness and Skills Training":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires organisations to implement incident handling and policies on human-factors security, both of which would mandate controls against social engineering campaigns of this type.","The campaign uses spear-phishing via Microsoft Teams messages — a direct instance of this technique — making detection and user training against Teams-based phishing vectors essential.","Ensuring staff are competent to recognise social engineering tactics — including impersonation over collaboration tools — directly addresses the human failure point this campaign exploits.","A defined incident response process including procedures for reporting suspicious IT contact attempts would enable faster triage and containment when mail bombing or rogue Teams messages are detected.","Users who could not identify IT impersonation scams or knew to verify support requests through official channels would have broken the attack chain before any malware was deployed.","Hardening Microsoft Teams external access settings — restricting unknown tenants and external chat — is a configuration management action that would have denied attackers their primary attack vector.","Robust identity verification controls and access policies would have prevented attackers from posing as IT staff and obtaining user-granted remote access without validated authentication.","published","2026-10-26T18:22:08.117128+00:00","2026-10-26T18:22:08.091+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-use-microsoft-teams-it.html","attackers-use-microsoft-teams-it-support-scams-to-deploy-malware-and-ransomware-4b8826","Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":48,"name":49,"slug":50,"description":51,"color":52},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[55,59,63],{"slug":56,"name":57,"problem":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":60,"name":61,"problem":62},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":64,"name":65,"problem":66},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]