Microsoft Warns of Hackers Abuse Teams Features and Capabilities to Deliver Malware
Microsoft has reported an increase in the misuse of Microsoft Teams features by both cybercriminals and state-sponsored threat actors. These entities exploit the platform's capabilities—such as messaging, calls, and screen-sharing—along various stages of…
Microsoft has reported an increase in the misuse of Microsoft Teams features by both cybercriminals and state-sponsored threat actors. These entities exploit the platform's capabilities—such as messaging, calls, and screen-sharing—along various stages of their attack processes.
The widespread adoption of Microsoft Teams for collaboration has made it a significant target. Attackers leverage Teams throughout the attack lifecycle, using its trusted status to infiltrate networks, steal data, and deploy malware. The attack chain often begins with reconnaissance, utilizing tools like TeamsEnum and TeamFiltration to identify users and organizational vulnerabilities.
Subsequent stages include resource development, where attackers may compromise or impersonate legitimate entities to gain initial access. Techniques such as social engineering and tech support scams are commonly employed. Threat actors also use Teams chats to deliver malicious links and payloads, with tools like AADInternals and TeamsPhisher aiding in the distribution of malware.
Microsoft has reported an increase in the misuse of Microsoft Teams features by both cybercriminals and state-sponsored threat actors.
After establishing access, attackers aim to maintain persistence and escalate privileges. This can involve adding guest accounts, abusing authentication flows, or using phishing to ensure long-term access. With elevated permissions, attackers conduct discovery and lateral movement using tools like AzureHound to map configurations and identify valuable data.
In some cases, external communication settings are altered to facilitate lateral movement between organizations. The attack culminates in data collection, command and control, and exfiltration stages, often leading to financial theft through extortion or ransomware.
Security experts recommend implementing a defense-in-depth strategy, focusing on strengthening identity and access controls, monitoring for unusual activities within Teams, and enhancing user security awareness through continuous training.
Based on reporting by Cyber Security News.