Kiberxavfsizlik tadqiqotchilari "takrorlanuvchi ijtimoiy muhandislik namunasi" deb ataydigan holatga e'tibor qaratmoqda — yuzlab holatlarda tahdidchilar Microsoft Teams'ning tashqi chat yaratish funksiyasidan foydalanib, shaxsni soxtalashtirish firibgarliklarini amalga oshirmoqda yoki zararli dastur tarqatmoqda.
"Ushbu hodisalar bo'yicha hujumchilarning izchil xatti-harakatlari namoyon bo'ldi: bir xil bir martalik ijarachilar, bir xil 'IT Support (Internal)' ko'rinish nomlari, bir xil masofaviy kirish vositalari va tobora bir xil yuklanish domenlari," — deb aytildi Arctic Wolf Labs hisobotida, u The Hacker News bilan baham ko'rildi.
Hujumlar doimo IT mavzusidagi ko'rinish nomlari yoki do'stona eshitiladigan ismlardan foydalanib, Teams'dagi tashqi foydalanuvchi ogohlantirishlarini chetlab o'tadi. Ushbu xabarlar yangi yaratilgan yoki sotib olingan Microsoft 365 ijarachilari orqali tashkil etilgan Teams identifikatorlaridan keladi.
Kiberxavfsizlik kompaniyasi tekshirgan holatlarning deyarli 30–40 foizida [*.onmicrosoft[.]com](https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain) ishlatilgan — bu Microsoft 365 ijarachisi yaratilganda avtomatik ravishda hosil bo'ladigan doimiy zaxira domen. Ushbu domenlar IT infratuzilmasi sifatida niqoblanadi, ijarachi nomi sifatida yordam stoli yoki qo'llab-quvvatlash mavzusidagi so'z tanlanadi, bu esa ishonchlilikni oshiradi:
- helpdeskteam365.onmicrosoft[.]com
- itendpoint365.onmicrosoft[.]com
- itcoreportal.onmicrosoft[.]com
- itadmin922.onmicrosoft[.]com
- corporateitservicellc.onmicrosoft[.]com
Ko'plab oldingi holatlarda kuzatilganidek, ushbu Teams sessiyalari oldidan pochta bombardimoni bilan boshlanadi — jabrlanuvchining pochta qutisi qisqa vaqt ichida yuzlab axborot byulleteni yoki obuna tasdiqlari bilan to'ldiriladi. Bu yondashuv soxta shoshilinch hissini uyg'otish uchun mo'ljallangan, shundan so'ng Teams'dagi IT qo'llab-quvvatlash xabari muammoni hal qilish uchun tezda yetib keladi.
Arctic Wolf turli holatlarda kuzatgan ba'zi ko'rinish nomlari quyidagilar:
- Help Desk
- IT Support
- HelpDesk Manager
- IT Service Desk – Liam / IT Service Desk (Liam)
- IT Service Desk – Matt / IT Service Desk – Scott
- IT Support – Christopher Thomas
- HelpDesk Supervisor
- Enterprise IT & Security (Internal)
- IT Tech Support Internal
- Business IT Solutions & Support (Internal)
- Maintenance Service
- IT-Representative
- IT/Help Desk
So'nggi iteratsiyalarda hujumchilar maqsad tashkilotining domeni yoki kompaniya nomini o'z ko'rinish nomiga qo'shib, xabarlarga qo'shimcha qonuniylik berishgan.
"Shuningdek, biz ijarachi yaratish uchun pullik yuqori darajali domenlarga (TLD) o'tishni kuzatdik," — deb aytdi Arctic Wolf. "So'nggi bir necha oy ichida ushbu turdagi firibgarliklarda aniqlangan pullik domenlardan taxminan 50 foizi soxta identifikatorlar .top TLD'dan foydalangan, taxminan 40 foizi standart .com domenidan, va biroz ko'proq besh foizi .com.pl, .com.vn va .com.br kabi ko'p darajali domenlardan foydalangan."
Faoliyat STAC4749 bilan mos keladi, u ".top" TLD ostida IT mavzusidagi bulut domenlarini yaratish va haqiqiy xodim foydalanuvchi nomlaridan foydalanib, hisoblarni haqiqiy ko'rinishga keltirish tarixiga ega. Sophos ma'lumotiga ko'ra, ushbu hujumlar Chaos to'lov dasturining tarqatilishiga olib kelgan.
Hujumlar ayniqsa tashqi kirish yoqilgan tashkilotlarga qaratiladi. Bu shuningdek, jabrlanuvchilarni Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport va LogMeIn kabi qonuniy masofaviy monitoring va boshqaruv (RMM) vositasi orqali qo'lda klaviatura kirishini berishga aldash uchun vishing elementini o'z ichiga oladi.
Masofaviy kirishdan foydalanib, razvedka o'tkaziladi, GoGRPC orqa eshigi kabi qo'shimcha yuklanishlar yetkaziladi, domen nazoratchilariga yonma-yon harakatlanish osonlashtiriladi va zaxira sifatida Level kabi qo'shimcha RMM vositalari tarqatiladi, so'ngra sezgir ma'lumotlar o'g'irlanadi va to'lov dasturi binari tushiriladi.
"Bir qator holatlarda hujumchilar Microsoft'ning eslatmalaridan foydalangan," — deb aytdi Arctic Wolf. "Hujumchilar odatda URL'ni to'g'ridan-to'g'ri Teams'ga joylashtirishdan qochadi, chunki bu Safe Links / ZAP skanerlashni ishga tushiradi, va buning o'rniga masofaviy sessiya davomida yuklanishni o'zlari navigatsiya qiladi. Shuning uchun, xabar skanerlash bilan bir qatorda, endpoint va identifikatsiya telemetriyasi muhim monitoring yuzalaridir."
Kiberxavfsizlik sotuvchisi aniqlagan bir holatda, tahdidchi foydalanuvchiga PowerShell buyrug'ini ishga tushirishni buyurgan — bu faylni yuklab olish va keyin uni ishga tushirish uchun. PowerShell buyrug'i Microsoft Azure Blob Storage'dan MSI o'rnatuvchini yuklab olish uchun mo'ljallangan.
Jabrlanuvchi o'rnatuvchini ishga tushirganda, u ichiga joylashtirilgan Python implantini chiqarib, bajaradigan PowerShell skriptini ishga tushiradi. Orqa eshik keyin yana bir MSI tranzaksiyasini ishga tushiradi, u Active Directory'dagi barcha kompyuter va foydalanuvchi obyektlari uchun LDAP so'rovlarini yuboradi va ma'lumotni tashqi serverga uzatadi.
"Tashqi Microsoft Teams chat dasturiy zaiflik emas, balki ishonchni suiiste'mol qilgani uchun samarali dastlabki kirish vektoriga aylandi," — deb aytdi Arctic Wolf.
"Tekshirilgan faoliyat bo'yicha, hujumchilar pochta bombardimoni, ishonarli IT qo'llab-quvvatlash shaxsni soxtalashtirishni, yangi yaratilgan ijarachilar va domenlarni, hamda tez ijtimoiy muhandislikni birlashtirib, jabrlanuvchilarni oddiy chatdan masofaviy kirish, yuklanish bajarilishi va ba'zi holatlarda kengroq buzilishga olib borishdi."
Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams or to deliver malware.
"A consistent pattern of attacker behavior has emerged across these incidents: the use of the same throwaway tenants, the same 'IT Support (Internal)' display names, the same remote-access tools, and increasingly, the same payload domains," Arctic Wolf Labs said in a report shared with The Hacker News.
The attacks consistently employ IT-themed display names or friendly-sounding first names to subvert external-user warnings in Teams. These messages originate from Teams identities established through newly created or acquired Microsoft 365 tenants.
Nearly 30–40% of the cases investigated by the cybersecurity company involve the use of [*.onmicrosoft[.]com](https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-or-replace-your-onmicrosoftcom-domain), a permanent fallback domain automatically generated by Microsoft when a Microsoft 365 tenant is created. These domains masquerade as IT infrastructure, opting for a help desk- or support-themed word as the tenant name to increase their credibility -
- helpdeskteam365.onmicrosoft[.]com
- itendpoint365.onmicrosoft[.]com
- itcoreportal.onmicrosoft[.]com
- itadmin922.onmicrosoft[.]com
- corporateitservicellc.onmicrosoft[.]com
As observed in many cases before, these Teams sessions are preceded by mail bombing, where the victim's inbox is flooded with hundreds of newsletter or subscription confirmations in a short span of time. The approach is designed to induce a false sense of urgency, with the Teams IT support message arriving soon after to help resolve the problem.
Some of the display names observed by Arctic Wolf across different cases are listed below -
- Help Desk
- IT Support
- HelpDesk Manager
- IT Service Desk – Liam / IT Service Desk (Liam)
- IT Service Desk – Matt / IT Service Desk – Scott
- IT Support – Christopher Thomas
- HelpDesk Supervisor
- Enterprise IT & Security (Internal)
- IT Tech Support Internal
- Business IT Solutions & Support (Internal)
- Maintenance Service
- IT-Representative
- IT/Help Desk
In recent iterations, the attackers have been observed adding the target organization's domain or company name in their display name to lend the messages additional legitimacy.
"We also observed a recent shift toward paid top-level domains (TLDs) for tenant creation," Arctic Wolf said. "Of the paid domains we identified in these types of scams over the past few months, approximately 50 percent of fake identities used the .top TLD, around 40 percent used a standard .com domain, and just over five percent used multi-level domains such as .com.pl, .com.vn, and .com.br."
The activity aligns with that of STAC4749, has a history of creating IT-themed cloud domains under the ".top" TLD and leveraging plausible employee usernames to make the accounts appear authentic. These attacks have led to the deployment of Chaos ransomware, according to Sophos.
The attacks specifically go after organizations where external access is enabled. This also involves an element of vishing to trick victims to granting them hands-on-keyboard access through a legitimate remote monitoring and management (RMM) tool like Quick Assist, AnyDesk, ScreenConnect (ConnectWise), TeamViewer, Atera, Zoho Assist, NetSupport, and LogMeIn.
The remote access is abused to conduct reconnaissance, deliver additional payloads like the GoGRPC backdoor, facilitate lateral movement to domain controllers, and deploy additional RMM tools like Level for redundancy, before exfiltrating sensitive data and dropping the ransomware binary.
"In a subset of cases, attackers leveraged Microsoft's notes," Arctic Wolf said. "Attackers generally avoid pasting a URL directly into Teams, which would trigger Safe Links / ZAP scanning, and instead navigate to the payload themselves during the remote session. Consequently, endpoint and identity telemetry are essential monitoring surfaces alongside message scanning.'
In one case identified by the cybersecurity vendor, the threat actor is said to have instructed the user to run a PowerShell command to download a file and then launch it. The PowerShell command is designed to download an MSI installer from Microsoft Azure Blob Storage.
When the victim runs the installer, it launches a PowerShell script responsible for extracting and executing a Python implant embedded within it. The backdoor then runs another MSI transaction that issues LDAP queries to Active Directory for all computer and user objects and then transmits the information to an external server.
"External Microsoft Teams chat has become an effective initial-access vector because it exploits trust rather than a software vulnerability," Arctic Wolf said.
"Across the activity examined, attackers combined email bombing, convincing IT-support impersonation, newly created tenants and domains, and rapid social engineering to move victims from a seemingly routine chat to remote access, payload execution, and, in some cases, broader compromise."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.