Arctic Wolf warns of Teams IT-support impersonation campaign
Attackers flood inboxes with spam, then pose as an IT service desk on Teams to obtain remote access, Arctic Wolf says.
Arctic Wolf researchers have warned of an ongoing social-engineering campaign in which attackers impersonate IT support over Microsoft Teams to obtain remote access to victims' systems, according to techradar.com. The firm says it has observed the pattern in more than 400 cases.
The scheme begins with a flood of spam. Victims receive hundreds or thousands of junk emails in a short period, filling their inboxes, before an attacker contacts them on Teams by message or call from an account posing as an IT service desk.
The fake support agent then asks the victim to grant remote access through Quick Assist, AnyDesk or ScreenConnect. Arctic Wolf notes that Teams ships with external access, also known as federation, enabled by default, and calls this the main enabler of the scheme. The firm says the activity does not exploit any known Teams vulnerability.
Once inside, the attackers install commercial remote monitoring and management (RMM) tools to keep a separate control channel and map the target's IT network.
Recommended defences
Arctic Wolf recommends that organisations move Teams external chat from an allow-all setting to an allow-list of trusted organisations, and train employees to recognise the approach.
Quick answers
Does the campaign exploit a vulnerability in Microsoft Teams?
No. Arctic Wolf says the activity does not exploit any known Teams vulnerability and relies on social engineering instead.
What tools do the attackers ask victims to use?
They request remote access through Quick Assist, AnyDesk or ScreenConnect, posing as an IT service desk.