A wide-scale and ongoing social engineering campaign has been identified, utilizing external Microsoft Teams chats as a primary vector for malware delivery. Security researchers have observed that this attack method facilitates a repeatable path for gaining unauthorized access to target environments.
The campaign, which has been described as a evolving approach to traditional “email bombing” tactics, reportedly takes advantage of the trusted nature of communication within collaboration platforms. By initiating contact through external Teams invitations or messages, attackers create a channel to deliver malicious payloads.
Initial reports suggest that the campaign may be associated with the Black Basta ransomware group, a known cybercriminal entity. The attack chain is characterized by its efficiency, with documented instances of the entire delivery process occurring within a 15-minute timeframe.
This development highlights the increasing focus by threat actors on exploiting enterprise communication and collaboration tools to bypass traditional email-based security filters. Organizations are advised to monitor external communication channels closely as attackers continue to refine their delivery mechanisms.
Source: Dark Reading
Original article: https://www.darkreading.com/cloud-security/email-bombing-external-teams-chats-repeatable-access-path
Leave a Reply