Hackers Abuse Microsoft Teams External Chat for Rapid Initial Access

Attackers are abusing the external chat creation feature in Microsoft Teams to target employees for initial access into corporate networks, Dark Reading and InfoSecurity Magazine reported. InfoSecurity Magazine reported that cybersecurity firm Arctic Wolf observed more than 400 incidents where hackers used this function for social engineering attacks. [1][2]

The malicious actors use highly consistent tactics by impersonating IT support staff to trick workers, according to InfoSecurity Magazine. Once a victim responds to the initial message, the attack chain moves rapidly to payload execution in under 15 minutes. [2]

Dark Reading reported that the wide-scale ongoing campaign features a new variation of mail bombing tactics. Dark Reading also reported that the activity might be tied to the Black Basta ransomware group, with the initial access leading to incidents such as ransomware deployments. [1][2]