Microsoft details an intrusion pattern that starts with fake IT support in Teams

Microsoft's Defender Research Team has published a detailed playbook on an intrusion campaign that abuses Microsoft Teams to exfiltrate sensitive data. The actors initiate cross-tenant Teams chats while posing as IT or helpdesk personnel, and socially engineer users into granting remote desktop access through tools such as Quick Assist. They then deploy payloads using DLL side-loading via trusted, vendor-signed applications to evade detection, before pivoting laterally through native administrative protocols such as WinRM. Commercial remote management software and transfer utilities such as Rclone are then used to stage and exfiltrate business data to external cloud storage.

What this means for your organisation

The entire chain rests on tools and protocols already present in the environment, each with legitimate uses. Traditional controls rarely fire as a result. The entry point is also a person making a sensible judgement on false premises, not a technical fault. The outcome is data theft, and for organisations under NIS2 or handling personal data, notification duties and documentation requirements follow in its wake.

Berigo recommends

• Disable or restrict Teams chats from external tenants to an approved list of partners.
• Limit Quick Assist and similar remote control tools to the IT department, and block them for everyone else.
• Set up detection for tools such as Rclone and for unexpected outbound traffic to cloud storage services.
• Review who is permitted to use WinRM internally and restrict it to the accounts that genuinely need it.

Source

• microsoft.com